2024-01-29_ca108d163681bea73587d40eeead97f3_mafia_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-01-29_ca108d163681bea73587d40eeead97f3_mafia_revil
Size 10.6MB
Sample240129-l2dbssggdr
SHA256 8a21db4a5911309c5fb3a693ca577a3f0f151e7a7fd85a993c9d6922b7436762
MD5 ca108d163681bea73587d40eeead97f3
SHA1 702a5a8d73fe4670eb90e4ca4a6a84c8b0766a12
SHA512 2fe6be8a947d7f08397b0fffeb9d175708568da9ad7bc1afb5496143b935b2054672aa160619c5f030a7da392502f7fba591d70c7e8d4b00ad7b9127a0fc7726
SSDEEP 98304:J3Hymfdaqx06wQ7hMbjFBKZbVsQdf60jpeuqVO/uDNQRfI4+hplRSWYj1mQF+R2Z:J3HynznbjOZbVj60suqiGlcJh3l7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

2024-01-29_ca108d163681bea73587d40eeead97f3_mafia_revil

.exe 10.6MB

2024-01-29_ca108d163681bea73587d40eeead97f3_mafia_revil

IMPHASH 87ffbd3f6ba14fce1f8ba383be1cec3e
SHA256 8a21db4a5911309c5fb3a693ca577a3f0f151e7a7fd85a993c9d6922b7436762
MD5 ca108d163681bea73587d40eeead97f3
SHA1 702a5a8d73fe4670eb90e4ca4a6a84c8b0766a12
SHA512 2fe6be8a947d7f08397b0fffeb9d175708568da9ad7bc1afb5496143b935b2054672aa160619c5f030a7da392502f7fba591d70c7e8d4b00ad7b9127a0fc7726
SSDEEP 98304:J3Hymfdaqx06wQ7hMbjFBKZbVsQdf60jpeuqVO/uDNQRfI4+hplRSWYj1mQF+R2Z:J3HynznbjOZbVj60suqiGlcJh3l7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Digest

9b:85:cf:9f:cb:0b:b6:6b:9b:4e:4a:4f:a6:cb:89:71:53:7f:a7:c8:a4:f9:01:ef:16:5f:59:ba:d5:cb:51:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Chains

Dec 25, 2023

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e6:56:0e:c7:d1:1c:0c:72:ac:3b:60:8a:6e:fe:11:f0:23:23:41:d8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Chains

Dec 25, 2023

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Serial Number

0f:84:4f:05:a8:06:45:4d:52:ef:d9:c9:c4:d3:00:e0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2022 - Sep 24, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=北京深盾科技股份有限公司,O=北京深盾科技股份有限公司,ST=北京市,C=CN

Serial Number

0f:84:4f:05:a8:06:45:4d:52:ef:d9:c9:c4:d3:00:e0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2022 - Sep 24, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11749197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ss_branches\ss_project\trunk\ss_v2.0_cp_privatised\package\pub\client\scp\kernel\system\senseshield.pdb

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

75KB

Virtual Size

962KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mark

Size

1024B

Virtual Size

812B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

512KB

Virtual Size

511KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2024-01-29_ca108d163681bea73587d40eeead97f3_mafia_revil

shlwapi

ws2_32

userenv

dbghelp

lib_net_agent_shared

shell32

version

advapi32

iphlpapi

psapi

kernel32

user32

gdi32

ole32

oleaut32

setupapi

rpcrt4

generic