2024-03-14_ad610e0e6680fcfd4b0cc86e34a96ca7_mafia

Reason

config extraction: CfgExtr crashed: 'Vidar' runtime error: index out of range [1] with length 1

General

Target

2024-03-14_ad610e0e6680fcfd4b0cc86e34a96ca7_mafia
Size

10.3MB
MD5

ad610e0e6680fcfd4b0cc86e34a96ca7
SHA1

021906849078bf6d3c378fa92f1b1afd8517fedd
SHA256

4fdc7d770003fa5f28e1a7cb801ef0bb8de4724e0ae60b5376c7bb6a02d63faa
SHA512

ba1d43bdb352cf6be496c46375d2157a0ab2fcb4b154e3b47724f50b50afd75af2c541a4371be1bea14c70c79f3d211634f8affb5e6cc57ae280768595b457a1
SSDEEP

196608:NL7WOhGFqMD3bTVoA6wrdFL+FrasjUn8yYl8wugVuxxuRvsvfo:Xu9zSwhFMraoU8yUgA8o

Score

10^/10

vmprotect

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-14_ad610e0e6680fcfd4b0cc86e34a96ca7_mafia