2024-01-26_932560271c0fda6df14774931a6b6b02_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-26_932560271c0fda6df14774931a6b6b02_mafia
Size

1.2MB
MD5

932560271c0fda6df14774931a6b6b02
SHA1

c652fed9b7bfc7563960867e5e806a2e5e1dd793
SHA256

b119ea88db3e66d6b5d853483443855d5cff5ec724198e03bb21b63cfe7e71f3
SHA512

48ca8595045c3286cb90a22b7d933d322b59d0c912fa5a7e876a66a8065fed2ea64800c793c088cdbececec80e1b0c5860075524230eb3713cf8013111cb3155
SSDEEP

24576:t5aCzAibVK/vOeg3DGkmVSZSB79WtsQPWWQVa+Db3WTXy5:tgCzAdHOeg3DXmVSe9WtswWlUXy5

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Files

2024-01-26_932560271c0fda6df14774931a6b6b02_mafia
.exe windows:5 windows x86 arch:x86

6a6dff0932b4c9205d8619dea44a75d1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17-11-2006 00:00

Not After

30-12-2020 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:1c:e4:36:56:4e:23:cc:d9:fb:ab:16:de:4b:92:7d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

26-10-2013 00:00

Not After

26-10-2015 23:59

Subject

CN=杭州如杰网络科技有限公司,OU=IT部门,O=杭州如杰网络科技有限公司,L=杭州,ST=浙江,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6a:86:05:96:e8:f6:2e:aa:bc:47:10:f4:be:4b:db:da:53:43:46:ae
Signer

Actual PE Digest

6a:86:05:96:e8:f6:2e:aa:bc:47:10:f4:be:4b:db:da:53:43:46:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
FindFirstFileA
CopyFileA
GetLocalTime
GetSystemTime
DeleteFileA
WTSGetActiveConsoleSessionId
OutputDebugStringA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetExitCodeProcess
GetModuleHandleExW
FormatMessageW
ExpandEnvironmentStringsW
GetNativeSystemInfo
GetVersionExW
GetSystemInfo
GetVersionExA
DeviceIoControl
CreateFileW
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
MoveFileW
GetTickCount
SetPriorityClass
GlobalFree
LoadLibraryW
GetEnvironmentVariableW
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
GetTempPathW
LockResource
lstrlenA
FindFirstFileW
FindClose
GetDriveTypeW
LocalFree
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateThread
GetTimeZoneInformation
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FatalAppExitA
ExitProcess
SetHandleCount
GetLocaleInfoW
WriteFile
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
GetCPInfo
LCMapStringW
GetStdHandle
GetFileType
WriteConsoleW
GetSystemTimeAsFileTime
GetStartupInfoW
HeapSetInformation
RtlUnwind
SystemTimeToFileTime
GetDiskFreeSpaceExW
CreateProcessW
CloseHandle
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
OutputDebugStringW
SetLastError
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
GetCurrentThreadId
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
InitializeCriticalSection
FileTimeToSystemTime
SetLocalTime
DecodePointer
EncodePointer
InterlockedExchange
GetStringTypeW
Sleep
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetCommandLineW
lstrlenW
GetCurrentProcess
WideCharToMultiByte
GetModuleFileNameW
GetLastError
WaitForSingleObject
CopyFileW

user32

GetDC
wsprintfW
SendMessageW
FindWindowW
SetWindowLongW
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
DestroyWindow
CreateDialogParamW
DefWindowProcW
EndDialog
GetWindowLongW
GetDlgItem
IsDialogMessageW
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
SetWindowTextW
EnableWindow
ReleaseDC
UnregisterClassA
LoadImageW
BeginPaint
EndPaint
UpdateLayeredWindow
PostQuitMessage
GetSystemMetrics
MessageBoxW
InvalidateRect
SetCursor
LoadCursorW
LoadBitmapW
ScreenToClient
PostMessageW
FillRect
MessageBoxA
GetWindowThreadProcessId
GetClassNameW
IsWindowVisible
EnumWindows
GetWindowTextW
EnumThreadWindows
FindWindowExW

advapi32

FreeSid
OpenServiceW
ControlService
QueryServiceStatus
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegSetValueExW
RegOpenKeyExW
OpenSCManagerW
CloseServiceHandle
DeleteService
RegQueryValueExW
DuplicateTokenEx
AllocateAndInitializeSid
GetLengthSid
SetTokenInformation
RegDeleteKeyW
CreateProcessAsUserW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW

ole32

OleInitialize
OleUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoInitializeSecurity

shell32

SHFileOperationW
ord155
SHCreateDirectoryExA
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderLocation
ShellExecuteExW
ShellExecuteW

oleaut32

GetErrorInfo
VarUI4FromStr
SysFreeString
SysAllocString
VariantInit
VariantClear
VariantChangeType
SetErrorInfo
CreateErrorInfo

shlwapi

UrlUnescapeW
StrStrIW
StrStrW

comctl32

InitCommonControlsEx

gdi32

CreateSolidBrush
BitBlt
DeleteDC
GetTextMetricsW
GetTextExtentExPointW
GetObjectA
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
DeleteObject
SelectObject

gdiplus

GdipRotateMatrix
GdipLoadImageFromFileICM
GdipFree
GdiplusShutdown
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipReleaseDC
GdipSetSmoothingMode
GdiplusStartup
GdipAlloc
GdipDeleteGraphics
GdipDrawImageRectI
GdipCloneImage
GdipDrawRectangleI
GdipCreateBitmapFromScan0
GdipDrawImagePointRectI
GdipCreateFont
GdipDrawImageRectRect
GdipDrawImageI
GdipMeasureString
GdipDrawLineI
GdipSetWorldTransform
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipGetImageGraphicsContext
GdipTransformPath
GdipAddPathRectangleI
GdipTranslateMatrix
GdipLoadImageFromFile
GdipCreateMatrix2
GdipCreateMatrix
GdipCreateBitmapFromGraphics
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipDeleteMatrix
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectRectI
GdipDrawString
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteBrush
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile

iphlpapi

GetAdaptersInfo

psapi

GetModuleBaseNameA
GetModuleFileNameExW
EnumProcessModules
EnumProcesses
GetModuleBaseNameW

wtsapi32

WTSQueryUserToken

winhttp

WinHttpWriteData
WinHttpCloseHandle
WinHttpReadData
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 857KB - Virtual size: 857KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a6dff0932b4c9205d8619dea44a75d1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

46:1c:e4:36:56:4e:23:cc:d9:fb:ab:16:de:4b:92:7dCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6a:86:05:96:e8:f6:2e:aa:bc:47:10:f4:be:4b:db:da:53:43:46:aeSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

comctl32

gdi32

gdiplus

iphlpapi

psapi

wtsapi32

winhttp

version

Sections

.text Size: 857KB - Virtual size: 857KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 177KB - Virtual size: 177KB

.reloc Size: 41KB - Virtual size: 41KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

46:1c:e4:36:56:4e:23:cc:d9:fb:ab:16:de:4b:92:7d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6a:86:05:96:e8:f6:2e:aa:bc:47:10:f4:be:4b:db:da:53:43:46:ae
Signer

.text
Size: 857KB - Virtual size: 857KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 177KB - Virtual size: 177KB

.reloc
Size: 41KB - Virtual size: 41KB