2024-02-25_dda05d66e9dc8ab836b1cb5427c2a400_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-25_dda05d66e9dc8ab836b1cb5427c2a400_mafia
Size

2.1MB
MD5

dda05d66e9dc8ab836b1cb5427c2a400
SHA1

aebca5d63efc60915c45cfe1a4b5938694301a88
SHA256

0b2e52af446f9e6588ef47d3864981190791dee4ada535d163bb0dd65e7378c3
SHA512

0b0521b21b92739ffd8e8e8cd42bbfdc16977f3d359c810a8a1dcb5a5e58ccdd4b0ee161286be8f16ca9937d3f651321653f04c657ce561d4b524e2a67660595
SSDEEP

49152:irpra69cnMJQdCZXSpVJtsKiE73mmrJNjqvFi2wtp/t0/8lyeZA:spBZXSJpsYvi/8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-25_dda05d66e9dc8ab836b1cb5427c2a400_mafia

Files

2024-02-25_dda05d66e9dc8ab836b1cb5427c2a400_mafia
.exe windows:5 windows x86 arch:x86

39f593acf024ff592459cf1cd8428c8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Code\agents\windows\Release\SnareCore03.pdb

Imports

kernel32

WaitForSingleObject
CreateMutexA
CreateEventA
SetEvent
ResetEvent
WaitForMultipleObjects
CloseHandle
SetProcessWorkingSetSize
GetProcessWorkingSetSize
GetCurrentProcess
FreeLibrary
FormatMessageA
LoadLibraryExA
ExpandEnvironmentStringsA
CreateDirectoryA
FindClose
FindFirstFileA
GetTickCount
GetFileAttributesA
ReleaseMutex
HeapFree
HeapAlloc
GetProcessHeap
lstrlenA
SetLastError
GetVersionExA
GetVersion
GetCurrentThreadId
GetTimeFormatA
GetDateFormatA
GetLocalTime
GetProcAddress
GetModuleHandleA
InterlockedDecrement
PeekConsoleInputA
ReadConsoleInputA
FlushConsoleInputBuffer
GlobalMemoryStatus
WideCharToMultiByte
Sleep
GetLastError
GetModuleFileNameA
LocalAlloc
LocalFree
GetStdHandle
GetConsoleMode
SetConsoleMode
FindNextFileA
ReadConsoleA
InterlockedCompareExchange
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
CreateFileW
SetEndOfFile
GetDriveTypeW
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LoadLibraryW
SetFilePointer
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
HeapSize
FlushFileBuffers
GetConsoleCP
LCMapStringW
GetModuleFileNameW
WriteFile
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FatalAppExitA
DeleteCriticalSection
GetStartupInfoW
GetSystemTime
MultiByteToWideChar
GetFileType
lstrlenW
InterlockedExchange
LoadLibraryA
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
ExitThread
ResumeThread
CreateThread
GetCommandLineA
HeapSetInformation
HeapReAlloc
GetModuleHandleW
ExitProcess
SetConsoleCtrlHandler
GetTimeZoneInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
ReadFile
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThread
SetHandleCount
GetNumberOfConsoleInputEvents

ole32

CoUninitialize
CoInitialize

oleaut32

VariantChangeType
SysFreeString
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
CreateErrorInfo
SetErrorInfo
SysAllocString
GetErrorInfo

ws2_32

socket
setsockopt
bind
listen
send
shutdown
closesocket
gethostname
WSAGetLastError
gethostbyname
WSACancelBlockingCall
WSACleanup
htons
select
recv
ioctlsocket
accept
__WSAFDIsSet
getsockopt
connect
inet_addr
WSAStartup
WSASetLastError
htonl
ntohs
getservbyname
ntohl
inet_ntoa

netapi32

NetUserGetInfo
NetQueryDisplayInformation
NetApiBufferFree
NetUserModalsGet
DsRoleFreeMemory
NetGroupGetUsers
NetLocalGroupGetMembers
DsGetDcNameA
DsGetDcOpenA
DsGetDcNextA
NetLocalGroupEnum
DsGetDcNameW
DsGetDcOpenW
DsGetDcNextW
DsGetDcCloseW
NetGetDCName
DsRoleGetPrimaryDomainInformation

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

gdi32

DeleteDC
GetBitmapBits
BitBlt
GetObjectA
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA
DeleteObject

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39f593acf024ff592459cf1cd8428c8f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

ws2_32

netapi32

setupapi

gdi32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 368KB - Virtual size: 368KB

.data Size: 54KB - Virtual size: 100KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 69KB - Virtual size: 68KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 368KB - Virtual size: 368KB

.data
Size: 54KB - Virtual size: 100KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 69KB - Virtual size: 68KB