# Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass

> A technical analysis of a completely rewritten Magniber ransomware variant (distinct from the original 2017 family) shows infection via an MSI installer with an obfuscated DLL executed through a Windows Installer CustomAction. The sample uses raw syscalls, a fodhelper.exe UAC bypass, and AES-128-CBC file encryption via Intel AES-NI instructions with RSA-protected keys, appending the '.vieijibfm' extension and dropping a README.html ransom note.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2481
- **ID:** TL-2026-2481
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-24880, CVE-2022-44698

## Description

This is a rewritten 2022 build of the Magniber ransomware family (first observed in 2017 targeting South Korea via the Magnitude Exploit Kit), analyzed in depth by researcher hasherezade in March 2023. The sample arrives as an MSI installer that abuses the Windows Installer CustomAction table to execute a binary ('utskzc') which calls an obfuscated exported function ('mvrtubhpxy'), loading the Magniber DLL without a directly-executable payload on disk. The binary is heavily obfuscated with extensive control-flow jump chains and malformed PE data directories that crash dynamic-tracing tools such as Pin Tracer, and it replaces standard WinAPI calls with raw NT syscalls (NtAllocateVirtualMemory, NtCreateUserProcess, NtCreateThreadEx, NtOpenProcess, NtCreateFile, NtOpenKey, NtSetValueKey, etc.) to evade userland API hooking and EDR telemetry. Independent of administrator status, the malware performs a UAC bypass by rewriting the HKCU\Software\Classes\ms-settings\Shell\Open\command registry value so that launching fodhelper.exe auto-elevates and runs Magniber's own commands with high integrity. A dropped, encrypted VBScript in C:\Users\Public\ deletes volume shadow copies via a WMI 'Win32_ShadowCopy' query, disables Windows' Controlled Folder Access protection by zeroing the EnableControlledFolderAccess registry value, drops a ransom-announcement wallpaper image, and self-deletes. File encryption uses a two-stage shellcode design: an injector stage followed by a core encryption engine that generates 16-byte AES keys (restricted to a 67-value byte set, still yielding ~1.65x10^29 possible keys) seeded from NtQueryPerformanceCounter, and encrypts eligible files with AES-128-CBC using Intel AES-NI hardware instructions (AESKEYGENASSIST/AESENC/AESENCLAST). The AES key and IV are then wrapped with a hardcoded 2048-bit RSA public key (e=0x10001); because each sample ships a single RSA keypair, all victims of that build share cryptographic exposure. Encrypted files are appended with the sample-specific extension '.vieijibfm', and a README.html ransom note is placed in every affected directory, directing victims to a Tor .onion negotiation site mirrored through victim-specific clearnet gateway URLs on the domain jobsoon.fun (e.g. http://<victim-id>vieijibfm.jobsoon.fun/). After encrypting 100 or more files, the malware beacons victim statistics (file counts, infection metrics) to a hardcoded domain over plain HTTP GET. This MSI/CustomAction/fodhelper delivery chain matches the broader 2022 evolution of Magniber documented by AhnLab ASEC, which also observed the family shift from running directly on msiexec.exe to injecting into legitimate processes around May 2022. The same operator subsequently pivoted to ZIP-archived JavaScript droppers (September 2022, using a DotNetToJScript variant) and then, from January 2023, to MSI installers with deliberately malformed Authenticode signatures that trigger a Windows SmartScreen error instead of a warning — a technique Google's Threat Analysis Group tracked as exploiting CVE-2023-24880 (a variant of the earlier CVE-2022-44698 SmartScreen/Mark-of-the-Web bypass), with over 100,000 malicious downloads observed, 80%+ concentrated in Europe. No public leak site or multi-affiliate RaaS structure has been identified for Magniber, and no specific threat actor group has been formally attributed.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1218.007 Msiexec
- T1059.005 Visual Basic
- T1106 Native API
- T1047 Windows Management Instrumentation
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1622 Debugger Evasion
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1490 Inhibit System Recovery
- T1071.001 Web Protocols

## Sources

- [Magniber ransomware analysis: Tiny Tracer in action](https://hshrzd.wordpress.com/2023/03/30/magniber-ransomware-analysis/)
- [Magniber ransomware actors used a variant of Microsoft SmartScreen bypass](https://blog.google/threat-analysis-group/magniber-ransomware-actors-used-a-variant-of-microsoft-smartscreen-bypass/)
- [Magniber Ransomware Targets Users with Fake Software Updates](https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/)
- [Magniber ransomware now infects Windows users via JavaScript files](https://www.bleepingcomputer.com/news/security/magniber-ransomware-now-infects-windows-users-via-javascript-files/)
- [Change in Injection Method of Magniber Ransomware](https://asec.ahnlab.com/en/36475/)
- [CVE-2023-24880 CVE Record](https://www.cve.org/CVERecord?id=CVE-2023-24880)
- [Ransomware Spotlight: Magniber](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-magniber)
- [Magnitude Exploit Kit Now Targeting Korea With Magniber Ransomware](https://www.trendmicro.com/en_us/research/17/j/magnitude-exploit-kit-now-targeting-korea-with-magniber-ransomware.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2481