Behavioral task
behavioral1
Sample
2024-03-12_737bcfb3475e71f463e7d9d8b1d06d9b_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_737bcfb3475e71f463e7d9d8b1d06d9b_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_737bcfb3475e71f463e7d9d8b1d06d9b_mafia
-
Size
424KB
-
MD5
737bcfb3475e71f463e7d9d8b1d06d9b
-
SHA1
e9b78a3f0f6299c17cfac2ba680945afa3143bd0
-
SHA256
4f5c5a59dc500730cf47069f875de298b75ebd08b953ff83ad1540ce461bf430
-
SHA512
ef010c823280299aae189319a0b6843419be94ea76b6d3696a8bd2c86e34744bf23aa91d9314b41a30ac8fb2367542f8d7e271fa3c7d6f8d48b6f99da47f7c61
-
SSDEEP
6144:TBA0i2uim7rAPtf9w8zSRWBt9JPpr+hTKWzYIRh6p/Q7u1:TG0iwj9w8zS4BPJPpr+YI10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-12_737bcfb3475e71f463e7d9d8b1d06d9b_mafia
Files
-
2024-03-12_737bcfb3475e71f463e7d9d8b1d06d9b_mafia.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ