2024-03-24_d56d856048f819a7c220c175cc6f931f_mafia_ramnit

General

Target
2024-03-24_d56d856048f819a7c220c175cc6f931f_mafia_ramnit
Size 359KB
Sample240324-ntf4tscd47
SHA256 6e9ce3467b2260c685da33969cf370cc211271d8b0ae6c848c2203446fcd0cc9
MD5 d56d856048f819a7c220c175cc6f931f
SHA1 2ba09a02862751c2de2032695d23bde98f7420cc
SHA512 dd4974e840998b6a51b75d0e5b732822c5dd6670929b350a8d33406a66925ff94567f788b0ab3d8fcfdcbe481ceb78c746bd4fb07549ffb4910738d15a00825a
SSDEEP 6144:HdHeuAbGuYVie+0T1ddxWTXOvXjfaz4WxXbhGUv0CNAuZJR/5YdJ/KG6TQ:HkuAbGuYVie+0TZxWTXOvXjfaz4WxXbM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-24_d56d856048f819a7c220c175cc6f931f_mafia_ramnit

File Explorer

2024-03-24_d56d856048f819a7c220c175cc6f931f_mafia_ramnit

.exe 359KB

2024-03-24_d56d856048f819a7c220c175cc6f931f_mafia_ramnit

IMPHASH ba6e7d1028cd73d291b266f23866459e
SHA256 6e9ce3467b2260c685da33969cf370cc211271d8b0ae6c848c2203446fcd0cc9
MD5 d56d856048f819a7c220c175cc6f931f
SHA1 2ba09a02862751c2de2032695d23bde98f7420cc
SHA512 dd4974e840998b6a51b75d0e5b732822c5dd6670929b350a8d33406a66925ff94567f788b0ab3d8fcfdcbe481ceb78c746bd4fb07549ffb4910738d15a00825a
SSDEEP 6144:HdHeuAbGuYVie+0T1ddxWTXOvXjfaz4WxXbhGUv0CNAuZJR/5YdJ/KG6TQ:HkuAbGuYVie+0TZxWTXOvXjfaz4WxXbM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

196608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb

kernel32

CloseHandle SetCommTimeouts CreateFileA WriteFile ReadFile Sleep GetTickCount GetSystemInfo GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetLastError GetFileType FindClose GetDriveTypeA FindFirstFileExA GetFileAttributesA EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleW ExitProcess DecodePointer SetFilePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent WideCharToMultiByte GetTimeZoneInformation SetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetStartupInfoW DeleteCriticalSection GetFullPathNameA HeapFree GetCurrentDirectoryW SetCurrentDirectoryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread GetConsoleCP GetConsoleMode SetEndOfFile HeapAlloc GetProcessHeap MultiByteToWideChar InterlockedExchange FatalAppExitA SetConsoleCtrlHandler FreeLibrary LoadLibraryW GetLocaleInfoW GetModuleFileNameW HeapSize HeapQueryInformation HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentProcessId RtlUnwind GetDriveTypeW LCMapStringW WriteConsoleW FlushFileBuffers GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW CompareStringW SetEnvironmentVariableA CreateDirectoryA

Name

.text

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

187KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-24_d56d856048f819a7c220c175cc6f931f_mafia_ramnit

kernel32

generic