Behavioral task
behavioral1
Sample
2024-03-13_7244f6f458a6f3f351668988380b42e1_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-13_7244f6f458a6f3f351668988380b42e1_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-13_7244f6f458a6f3f351668988380b42e1_mafia
-
Size
472KB
-
MD5
7244f6f458a6f3f351668988380b42e1
-
SHA1
ad644f79901ff093a56b4c74500ac3cd671c8cb6
-
SHA256
cffe9c9b50bdbc7b69ee50b7430c64d5e18820d2834f797fe9d3655348905ecc
-
SHA512
304db74c7d6567d8ad95806c16d94ce34628ca592bf28d2ad903e768efa3b76f1a970ecc45e32a1afd59e80ccbef4b7e45c494353b644191761384a4fe75d0f5
-
SSDEEP
6144:nCyiXVZhMMOP/AXh/PP6IEWEonebA8mUG05UJKH2khp9j5kz+i9moRQUJg4EahrT:ndiXZMbKCxWIW+kmoRQU24EyiPlIn
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-13_7244f6f458a6f3f351668988380b42e1_mafia
Files
-
2024-03-13_7244f6f458a6f3f351668988380b42e1_mafia.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ