MagniberMalware
According to TXOne, The Magniber ransomware was first identified in late 2017 when it was discovered using the Magnitude Exploit Kit to conduct malvertising attacks against users in South Korea. However, it has remained active since then, continually updating its tactics by employing new obfuscation techniques and methods of evasion.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“Computer vision for button recognition, even including decoy images masquerading as buttons”
- T1497.001System Checks
“Virtual machine morphing technology helps to detect advanced attacks even if adversaries use evasion techniques, such as system checks, to discover virtual environments.”
- T1684Social Engineering
“Social engineering attacks usually require human interaction, such as clicking a button to execute a malicious macro, tapping a link that redirects a specific target to the payload, or others.”
What the reports say
1 report, newest first · the exact sentence from each-
Managed upgrades. Enhance malware analysis efficiency with Group-IB Malware Detonation Platform updates“In Figures 2 and 3 below (sha1: 93619242ed888edfa3871035e0668cffa3643420), Magniber – a highly targeted ransomware strain designed to attack targets exclusively in South Korea – is executed and detonated correctly only when run on a machine with a Korean locale.”
Indicators in its reports
named in the reports above- 93619242ed888edf…8cffa3643420in 1 report
- 8247a571f464aadf…1316246a1fccin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.