2024-01-18_5cb0202539c25c8769be2ba37171ea18_karagany_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-18_5cb0202539c25c8769be2ba37171ea18_karagany_mafia
Size

1.3MB
MD5

5cb0202539c25c8769be2ba37171ea18
SHA1

880a3f86e5168b3ca8b2ca55c941035f99fbb553
SHA256

cf878ccabc2aeade743c2ea7bee9f3663439354a882bea65e64d2fb43700665e
SHA512

7eb05000fa633b59b8841790bfda4a3afa2e563128a9b6c24935e938123467226995bdbe57152b7c552e2f8fde0a90bc389161f65a0db3ca28e0a926cd3bd08b
SSDEEP

24576:5lYRbQT+d+IUrE90iJEHxfLaHU0OsyWWqvd2Zuxw7MLm5j:C+U90iJwfLaHDzyWWqlEuuMLGj

Score

1^/10

Malware Config

Signatures

Files

2024-01-18_5cb0202539c25c8769be2ba37171ea18_karagany_mafia
.exe windows:5 windows x86 arch:x86

31447b48743b30367f4cc70648b06397

Code Sign

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

02/08/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:ad:a6:2f:02:e4:16:21:b0:b0:11:fc:c7:35:c9:4f:de
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

10/12/2014, 03:02

Not After

10/12/2017, 03:02

Subject

CN=Baidu Japan Inc.,O=Baidu Japan Inc.,L=Minato,ST=Tokyo,C=JP,1.2.840.113549.1.9.1=#0c11696e666f5f6a704062616964752e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

91:b9:d4:f3:6f:c9:0a:50:96:76:ca:9a:f7:9d:e0:8e:34:7c:f8:04
Signer

Actual PE Digest

91:b9:d4:f3:6f:c9:0a:50:96:76:ca:9a:f7:9d:e0:8e:34:7c:f8:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAIoctl
htonl
freeaddrinfo
getaddrinfo

wininet

InternetOpenW
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
InternetCrackUrlW
InternetReadFile
InternetConnectW

shlwapi

PathGetDriveNumberW
PathCombineW
PathFindFileNameW
PathAppendW
PathFileExistsW
PathStripPathW
PathRemoveFileSpecW
PathFindExtensionW
PathIsDirectoryW

iphlpapi

GetAdaptersAddresses
GetIpForwardTable

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcesses

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
CloseHandle
WaitForSingleObject
ExpandEnvironmentStringsW
SetEvent
DeleteFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
CreateFileA
DeviceIoControl
GlobalFree
GlobalAlloc
WideCharToMultiByte
DeleteCriticalSection
TerminateThread
GetTickCount
lstrlenA
InitializeCriticalSection
CreateSemaphoreW
ReleaseSemaphore
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
WriteFile
SetEndOfFile
SetFilePointer
CreateFileW
GetLastError
Sleep
GetUserDefaultUILanguage
FindNextFileW
FindFirstFileW
lstrlenW
GetTimeZoneInformation
CreateDirectoryW
QueryDosDeviceW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpiW
GetFileAttributesW
lstrcpyW
GetProcAddress
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
GetWindowsDirectoryW
GetCurrentProcessId
LocalFree
GetCommandLineW
CreateMutexW
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetExitCodeProcess
CopyFileW
GetLocalTime
DecodePointer
RemoveDirectoryW
TlsSetValue
RaiseException
GlobalUnlock
GlobalLock
CreateFileMappingW
GetFileSize
UnmapViewOfFile
MapViewOfFile
GetTempPathW
InterlockedExchange
GetDiskFreeSpaceExW
GetVolumeInformationW
OpenFileMappingW
MoveFileExW
GetDriveTypeW
ReadFile
SleepEx
GetVersionExA
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueueTimer
CreateTimerQueue
PeekNamedPipe
FreeLibrary
GetStdHandle
LoadLibraryA
GetFileType
WaitForMultipleObjects
ExpandEnvironmentStringsA
FormatMessageA
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapReAlloc
HeapSize
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
FindClose
GetDriveTypeA
FindFirstFileExA
LCMapStringW
GetCPInfo
GetLocaleInfoW
TlsAlloc
TlsFree
TerminateProcess
UnhandledExceptionFilter
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
SetStdHandle
FlushFileBuffers
GetFullPathNameA
GetCurrentDirectoryW
GetStartupInfoW
HeapSetInformation
CreateThread
ExitThread
SetHandleCount
GetStringTypeW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
EncodePointer
InterlockedDecrement
InterlockedIncrement
RtlUnwind
FreeResource
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileSectionNamesW
TlsGetValue
GetPrivateProfileSectionW

user32

TranslateMessage
GetMessageW
wsprintfW
SendMessageW
GetClientRect
RedrawWindow
MapWindowPoints
GetMonitorInfoW
DispatchMessageW
DestroyWindow
CharNextW
MonitorFromWindow
IsWindowVisible
GetWindowRect
CallWindowProcW
GetWindowLongW
SetForegroundWindow
UpdateLayeredWindow
PostMessageW
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetCursorPos
WindowFromPoint
GetCapture
ReleaseCapture
LoadCursorW
GetClassInfoExW
SetCapture
ReleaseDC
GetDC
SetWindowPos
SetWindowLongW
GetCursor
SetCursor
GetWindow
GetParent
LoadImageW
GetSystemMetrics
MsgWaitForMultipleObjectsEx
PeekMessageW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ClientToScreen
PostQuitMessage
LoadIconW
DestroyIcon
FindWindowW
UnregisterClassA
IsWindow

advapi32

RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegQueryInfoKeyW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateGuid

shell32

Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW

oleaut32

SysFreeString
VariantClear
SysAllocString

gdi32

DeleteObject
CreateCompatibleDC
SelectObject
CreateDIBSection
DeleteDC
SetBitmapBits
GetBitmapBits

gdiplus

GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneBrush
GdipDeleteFontFamily
GdipDrawRectangleI
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipAlloc
GdipFree
GdipDeleteBrush
GdipDrawImageRectRect
GdipSetImageAttributesWrapMode
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateFont
GdipDeleteFont
GdipSetStringFormatAlign
GdipDrawString
GdiplusStartup
GdiplusShutdown
GdipCreatePath
GdipDeletePath
GdipGetPathWorldBounds
GdipAddPathString
GdipLoadImageFromStream
GdipDisposeImage
GdipFillRectangleI
GdipCloneImage

wsock32

gethostname
inet_ntoa
listen
accept
recvfrom
sendto
select
__WSAFDIsSet
send
getpeername
WSAStartup
getsockopt
closesocket
WSASetLastError
socket
bind
recv
setsockopt
getsockname
ntohs
htons
WSAGetLastError
connect
WSACleanup

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpCloseHandle

wldap32

ord301
ord27
ord33
ord79
ord30
ord60
ord26
ord211
ord46
ord143
ord50
ord22
ord35
ord32
ord200
ord41

Sections

.text
Size: 676KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 443KB - Virtual size: 442KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31447b48743b30367f4cc70648b06397

Code Sign

04:00:00:00:00:01:31:89:c6:37:e8Certificate

Extended Key Usages

Key Usages

11:21:ad:a6:2f:02:e4:16:21:b0:b0:11:fc:c7:35:c9:4f:deCertificate

Extended Key Usages

Key Usages

91:b9:d4:f3:6f:c9:0a:50:96:76:ca:9a:f7:9d:e0:8e:34:7c:f8:04Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

shlwapi

iphlpapi

psapi

version

kernel32

user32

advapi32

ole32

shell32

oleaut32

gdi32

gdiplus

wsock32

winhttp

wldap32

Sections

.text Size: 676KB - Virtual size: 676KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 18KB - Virtual size: 30KB

.rsrc Size: 443KB - Virtual size: 442KB

.reloc Size: 46KB - Virtual size: 45KB

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

11:21:ad:a6:2f:02:e4:16:21:b0:b0:11:fc:c7:35:c9:4f:de
Certificate

91:b9:d4:f3:6f:c9:0a:50:96:76:ca:9a:f7:9d:e0:8e:34:7c:f8:04
Signer

.text
Size: 676KB - Virtual size: 676KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 18KB - Virtual size: 30KB

.rsrc
Size: 443KB - Virtual size: 442KB

.reloc
Size: 46KB - Virtual size: 45KB