2024-03-10_c1acb2ed9a95574b65fbbf76694c50ee_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-10_c1acb2ed9a95574b65fbbf76694c50ee_mafia
Size

2.4MB
MD5

c1acb2ed9a95574b65fbbf76694c50ee
SHA1

068a966067602d06c2b37f37b2ce432e6901b603
SHA256

f41d7fb986529fecdacf4df1b1aa6d622565c94f4af1c433617650d57a537022
SHA512

bc16c6519b7161a4b160df6a4e64e34946f1fab127787a0f93988c5567d72fab73e5eb013bfc7b35035e83295439c898b024d7b700d1bcffd046d80d4399b2a1
SSDEEP

49152:szIxw8iDyBD04MUfCBf1o56zWxrnxykOFUCPjO1EODhHfo6zKObzu6mSVBjVKoTe:zwB0of1o56zWxbxyvFUf1Xh/pzKC378/

Score

1^/10

Malware Config

Signatures

Files

2024-03-10_c1acb2ed9a95574b65fbbf76694c50ee_mafia
.exe windows:5 windows x86 arch:x86

1389d67cfe479ed6f92353374da28cd0

Code Sign

01:5c:75:77:65:8f:86:a6:37:70:65:85:2e:9e:2c:a2
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/06/2014, 00:00

Not After

22/06/2015, 12:00

Subject

CN=Adlice,O=Adlice,L=Orvault,ST=Loire Atlantique,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:7b:2b:17:03:8c:f5:fa:96:53:9b:46:da:59:5b:10:a2:c5:61:ae
Signer

Actual PE Digest

f9:7b:2b:17:03:8c:f5:fa:96:53:9b:46:da:59:5b:10:a2:c5:61:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Tools\RogueKillerV8\Release\RogueKillerCMD.pdb

Imports

kernel32

MoveFileW
GetDiskFreeSpaceW
FindClose
CreateFileMappingW
RemoveDirectoryW
DeviceIoControl
FindNextFileW
GetFileAttributesExW
SetFileAttributesW
ExpandEnvironmentStringsW
GetComputerNameW
GetSystemDirectoryW
GetCurrentProcessId
GetPrivateProfileStringW
WritePrivateProfileStringW
GetVersionExW
InterlockedDecrement
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetSystemTime
LocalAlloc
GetDriveTypeW
QueryDosDeviceW
GetDiskFreeSpaceExW
GetFullPathNameW
GetCurrentDirectoryW
GetShortPathNameW
lstrcmpA
lstrcpyW
VerSetConditionMask
VerifyVersionInfoW
OutputDebugStringA
GetVersionExA
SuspendThread
FindResourceW
LoadResource
SizeofResource
LockResource
GetFullPathNameA
HeapReAlloc
CreateFileA
HeapCompact
SetEndOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
FlushFileBuffers
GetTempPathW
HeapSize
ReadFile
EnterCriticalSection
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
DeleteCriticalSection
GetTempPathA
AreFileApisANSI
DeleteFileA
SetFilePointerEx
VirtualFree
IsBadReadPtr
GetCompressedFileSizeW
WaitForMultipleObjectsEx
GetVolumePathNameW
IsBadWritePtr
lstrlenW
VirtualAlloc
GetFileType
lstrcmpiW
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
GetVolumeInformationW
LoadLibraryExW
GlobalAlloc
GlobalFree
GetFileSizeEx
CreateMutexA
GetFileAttributesW
GetLongPathNameW
SetEnvironmentVariableA
WriteConsoleW
CreateProcessA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
Sleep
WriteFile
CreateDirectoryW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
SetFilePointer
FindFirstFileW
GetFileSize
DeleteFileW
CopyFileW
ReleaseMutex
GetConsoleScreenBufferInfo
GetStdHandle
FormatMessageW
LoadLibraryW
GetLastError
SetConsoleScreenBufferSize
GetCurrentProcess
SetConsoleTextAttribute
FreeLibrary
SetErrorMode
CreateMutexW
CloseHandle
TerminateJobObject
Module32NextW
CreateToolhelp32Snapshot
Process32NextW
Module32FirstW
OpenThread
Process32FirstW
GetProcAddress
SetLastError
GetModuleFileNameW
Thread32Next
TerminateProcess
GetExitCodeProcess
ReadProcessMemory
AssignProcessToJobObject
TerminateThread
Thread32First
OpenProcess
CreateRemoteThread
GetProcessHeap
WaitForSingleObject
HeapFree
CreateJobObjectW
HeapAlloc
LocalFree
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
IsValidCodePage
GetOEMCP
GetACP
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
LCMapStringW
RaiseException
GetCPInfo
HeapSetInformation
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedIncrement
lstrlenA
CreateFileW
GetUserDefaultUILanguage
GetThreadLocale
GetLocaleInfoW
GetUserGeoID
GetGeoInfoW
GetModuleHandleW
LockFileEx
VirtualQueryEx

user32

SystemParametersInfoW
LoadStringW
GetSystemMetrics
EnumWindows
GetWindowTextW
GetWindowThreadProcessId

advapi32

RegDeleteKeyW
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueW
InitializeAcl
AllocateAndInitializeSid
ConvertSidToStringSidW
GetInheritanceSourceW
RegSetKeySecurity
IsValidSid
GetNamedSecurityInfoW
RegGetKeySecurity
SetNamedSecurityInfoW
ConvertStringSidToSidW
FreeInheritedFromArray
GetExplicitEntriesFromAclW
QueryServiceConfigW
ControlService
EnumServicesStatusW
QueryServiceStatus
StartServiceW
RegQueryValueExW
QueryServiceConfig2W
OpenServiceW
EnumDependentServicesW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
GetUserNameW
RegUnLoadKeyW
RegSetValueExW
RegCloseKey
RegLoadKeyW
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
AdjustTokenPrivileges
CheckTokenMembership
IsValidSecurityDescriptor
FreeSid
SetEntriesInAclW
SetSecurityDescriptorOwner
LookupPrivilegeValueA

shell32

CommandLineToArgvW
SHGetFolderPathW

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoUninitialize

oleaut32

SysStringLen
VariantClear
SysFreeString
VariantInit
SysAllocString

wininet

InternetGetConnectedState
InternetCrackUrlW

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

ntdll

NtOpenKey
NtQueryKey
NtLoadDriver
NtSetValueKey
NtDeleteKey
NtQuerySystemInformation
RtlUnwind
NtDeleteValueKey
NtUnloadDriver
RtlInitUnicodeString

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

userenv

GetProfilesDirectoryW

crypt32

CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
CryptMsgClose

wintrust

CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext

shlwapi

PathUnExpandEnvStringsW
PathIsDirectoryW
PathFindExtensionW
PathGetArgsW
PathIsRelativeW
PathFindFileNameW
PathCanonicalizeW
PathGetDriveNumberW
PathIsPrefixW
PathFileExistsW
PathIsNetworkPathW
PathSearchAndQualifyW
PathUnquoteSpacesW
PathIsRootW
PathQuoteSpacesW
PathRemoveArgsW
PathMakePrettyW
StrCmpIW
StrDupW
StrCmpNIW
PathRemoveBlanksW

winhttp

WinHttpSetOption
WinHttpReceiveResponse
WinHttpOpen
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReadData

iphlpapi

GetAdaptersAddresses

ws2_32

WSAAddressToStringW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1389d67cfe479ed6f92353374da28cd0

Code Sign

01:5c:75:77:65:8f:86:a6:37:70:65:85:2e:9e:2c:a2Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

f9:7b:2b:17:03:8c:f5:fa:96:53:9b:46:da:59:5b:10:a2:c5:61:aeSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

psapi

ntdll

version

userenv

crypt32

wintrust

shlwapi

winhttp

iphlpapi

ws2_32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 271KB - Virtual size: 271KB

.data Size: 112KB - Virtual size: 135KB

.rsrc Size: 434KB - Virtual size: 433KB

.reloc Size: 89KB - Virtual size: 88KB

01:5c:75:77:65:8f:86:a6:37:70:65:85:2e:9e:2c:a2
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

f9:7b:2b:17:03:8c:f5:fa:96:53:9b:46:da:59:5b:10:a2:c5:61:ae
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 271KB - Virtual size: 271KB

.data
Size: 112KB - Virtual size: 135KB

.rsrc
Size: 434KB - Virtual size: 433KB

.reloc
Size: 89KB - Virtual size: 88KB