Static task
static1
Behavioral task
behavioral1
Sample
2024-01-18_866c4b468a376f22bbdf393d9b47a4b8_karagany_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-18_866c4b468a376f22bbdf393d9b47a4b8_karagany_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-18_866c4b468a376f22bbdf393d9b47a4b8_karagany_mafia
-
Size
255KB
-
MD5
866c4b468a376f22bbdf393d9b47a4b8
-
SHA1
42c1ed018676b7f0c6c627a72623cb8bbfe134fd
-
SHA256
f4f2eebb86d0974193e0b0493a31b7204618060fcf60b96ffca3285c16879f6e
-
SHA512
235d5840be1a4a3034363eb2fa77f31049657e97ac65c04a53ff6b70771a1376a7e4daf20bae1e30a7db318946a869724880dd679ad6b58dc2cac38fa2084eb3
-
SSDEEP
3072:AyR64m3uiNEib+3NlcpX0XEtnvJzfQcHa8fiLtPy0AV5ODgnVqTLA4OmsWF:nH6Gh3vK0XEtJDHhfyylODgnMo4nsM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-18_866c4b468a376f22bbdf393d9b47a4b8_karagany_mafia
Files
-
2024-01-18_866c4b468a376f22bbdf393d9b47a4b8_karagany_mafia.exe windows:5 windows x86 arch:x86
56544831523e9e8f64e42a4d6aeb1ade
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
FindActCtxSectionStringW
SetVolumeMountPointA
GetProcAddress
LoadLibraryW
GetQueuedCompletionStatus
GlobalDeleteAtom
GetCPInfoExA
lstrlenA
ReadFile
GetProcessHeap
SetEndOfFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
RtlUnwind
RaiseException
GetCommandLineW
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
CloseHandle
CreateFileA
CreateFileW
user32
GetCaretPos
DdeClientTransaction
GetPropW
ole32
CoGetCurrentProcess
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ