mafiaware666 | be9ed7b1e2219fb64293248dc95d0de3e74c27daa26e5f7ef743c74b58ef950d

Resubmissions

12-04-2023 11:41

31-03-2023 17:39

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 11:41

Target

Ransomware.exe
Size

322KB
MD5

39f33d6842fa6495ccd7a41e8ddcb9b8
SHA1

61cd2b3e22e2e6e514d611d3154e001f7e9fd195
SHA256

416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb
SHA512

97e8b15b82b70efebbf5cbfbbd4ac4925a7300049f5866bf01b59396de43c633342b5bc2ed657aae573c9f77e2dd20fe67234110aef048c49a2af9c8bd45dc29
SSDEEP

3072:iMMFnguNpdYSkMXV2KMMEuWgY792XaY6UTuuAk2usbA+klAGPqhdp4efHxub8ehY:ideMXVeuWgY79OWpmq/yQxuAeS9Jb/

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/100-133-0x0000000000530000-0x0000000000586000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

Processes:

Ransomware.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\SkipInvoke.crw.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\WaitUnpublish.tif.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\ApproveRegister.raw.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\CloseReceive.tiff.Locked	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\CloseReceive.tiff	Ransomware.exe
File created	C:\Users\Admin\Pictures\ExportClear.crw.Locked	Ransomware.exe
File created	C:\Users\Admin\Pictures\MeasureNew.png.Locked	Ransomware.exe

Drops desktop.ini file(s) 5 IoCs

Processes:

Ransomware.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Ransomware.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Ransomware.exe

memory/100-133-0x0000000000530000-0x0000000000586000-memory.dmp

Filesize
344KB

Download
memory/100-134-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/100-135-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/100-136-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/100-137-0x0000000004F50000-0x0000000004F5A000-memory.dmp

Filesize
40KB

Download
memory/100-138-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/100-147-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/100-150-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download