mafiaware666 | be9ed7b1e2219fb64293248dc95d0de3e74c27daa26e5f7ef743c74b58ef950d

Resubmissions

12/04/2023, 11:41 UTC

230412-ntr64ade2t 10

31/03/2023, 17:39 UTC

230331-v8d2cadd8y 10

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2023, 11:41 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware.exe
Size

322KB
MD5

39f33d6842fa6495ccd7a41e8ddcb9b8
SHA1

61cd2b3e22e2e6e514d611d3154e001f7e9fd195
SHA256

416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb
SHA512

97e8b15b82b70efebbf5cbfbbd4ac4925a7300049f5866bf01b59396de43c633342b5bc2ed657aae573c9f77e2dd20fe67234110aef048c49a2af9c8bd45dc29
SSDEEP

3072:iMMFnguNpdYSkMXV2KMMEuWgY792XaY6UTuuAk2usbA+klAGPqhdp4efHxub8ehY:ideMXVeuWgY79OWpmq/yQxuAeS9Jb/

Score

10^/10

mafiaware666 ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/100-133-0x0000000000530000-0x0000000000586000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\SkipInvoke.crw.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\WaitUnpublish.tif.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\ApproveRegister.raw.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\CloseReceive.tiff.Locked	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\CloseReceive.tiff	Ransomware.exe
File created	C:\Users\Admin\Pictures\ExportClear.crw.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\MeasureNew.png.Locked	Ransomware.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Ransomware.exe

C:\Users\Admin\AppData\Local\Temp\Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:100

Network

DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

17.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.160.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

0.77.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.77.109.52.in-addr.arpa

IN PTR

Response

40.74.98.192:443

322 B
7
52.152.110.14:443

260 B
5
173.223.113.164:443

322 B
7
173.223.113.131:80

322 B
7
204.79.197.203:80

322 B
7
52.152.110.14:443

260 B
5
93.184.221.240:80

322 B
7
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5
52.152.110.14:443

260 B
5
52.152.110.14:443

208 B
4

8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

17.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

17.160.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

0.77.109.52.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

0.77.109.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100-133-0x0000000000530000-0x0000000000586000-memory.dmp

Filesize
344KB

Download
memory/100-134-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/100-135-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/100-136-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/100-137-0x0000000004F50000-0x0000000004F5A000-memory.dmp

Filesize
40KB

Download
memory/100-138-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/100-147-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/100-150-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.