2024-04-05_3fe074b17fe354d6cec4315d6732ed82_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-05_3fe074b17fe354d6cec4315d6732ed82_mafia
Size

1.1MB
MD5

3fe074b17fe354d6cec4315d6732ed82
SHA1

b4f253218bbe7672e090bb6503916ee10be55aa0
SHA256

501d510bf5a5c00870e14b9a01a9d7fd66c9c6b97764321ff015b99f43dc88ab
SHA512

363f27d9c661733192be90fe596fc8dd8fca9eb6f1dbcc2e3c5d9ac6bd9ef9e0aa66008f7020a4183fe2dab8381952c1b890f59ecd3ce4150f2f838e374dbf87
SSDEEP

24576:ojWJdINAUdpiP7dqHyj5ZQVbso24W3kuNeMoaDjbLOPG:fIzEwX9D24WbwFeLOPG

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Files

2024-04-05_3fe074b17fe354d6cec4315d6732ed82_mafia
.exe windows:5 windows x86 arch:x86

beb8b49f33de836148d6822013c1fa9b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:1c:e4:36:56:4e:23:cc:d9:fb:ab:16:de:4b:92:7d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

26/10/2013, 00:00

Not After

26/10/2015, 23:59

Subject

CN=杭州如杰网络科技有限公司,OU=IT部门,O=杭州如杰网络科技有限公司,L=杭州,ST=浙江,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

eb:65:a0:0b:b9:63:82:da:65:45:0b:6d:d1:b2:62:76:40:62:3d:71
Signer

Actual PE Digest

eb:65:a0:0b:b9:63:82:da:65:45:0b:6d:d1:b2:62:76:40:62:3d:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\b5m-client-search\ruyiso\RYSProject\bin\Release\RYSInstall.pdb

Imports

kernel32

CreateFileW
GlobalFree
Sleep
CopyFileW
FindClose
FindFirstFileW
MoveFileExW
GetTempPathW
CreateFileA
FindFirstFileA
CopyFileA
GetLocalTime
GetSystemTime
DeleteFileA
WTSGetActiveConsoleSessionId
WideCharToMultiByte
OutputDebugStringA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleExW
FormatMessageW
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
LoadLibraryW
GetSystemDirectoryW
GetEnvironmentVariableW
SetLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetNativeSystemInfo
GetVersionExW
GetSystemInfo
GetVersionExA
FindNextFileW
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
MoveFileW
GetTickCount
DeviceIoControl
SetPriorityClass
CreateThread
SetFileTime
CompareFileTime
CloseHandle
GetModuleFileNameW
LoadLibraryExW
LocalFree
FindResourceW
CompareStringW
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetConsoleCtrlHandler
FlushFileBuffers
SetFilePointer
WriteFile
FatalAppExitA
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
GetTimeZoneInformation
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
GetStdHandle
GetFileType
WriteConsoleW
GetStartupInfoW
HeapSetInformation
GetCommandLineW
RtlUnwind
GetSystemTimeAsFileTime
DecodePointer
LockResource
lstrlenA
CreateSemaphoreW
OutputDebugStringW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
SetLastError
InitializeCriticalSection
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
RaiseException
EncodePointer
InterlockedExchange
GetStringTypeW
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
ReadFile
CreateProcessW
EnterCriticalSection
SetEnvironmentVariableA

user32

EnumWindows
DestroyWindow
CreateDialogParamW
wsprintfW
DefWindowProcW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
BeginPaint
EndPaint
CallWindowProcW
GetWindowLongW
SendMessageW
CreateWindowExW
SetWindowTextW
GetDlgItem
MessageBoxW
MoveWindow
InvalidateRect
EnableWindow
GetParent
PostMessageW
SetWindowPos
SetWindowLongW
ShowWindow
GetWindowRect
ScreenToClient
IsWindowVisible
IsWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
FindWindowW
DispatchMessageW
UnregisterClassA
TranslateMessage
GetMessageW
LoadImageW
PostQuitMessage
EndDialog
IsDialogMessageW
GetSystemMetrics
MessageBoxA
GetWindowThreadProcessId
GetClassNameW
CharNextW
PeekMessageW
FindWindowExW
EnumThreadWindows

gdi32

CreateFontW
DeleteDC
GetObjectA

advapi32

ControlService
OpenSCManagerW
CloseServiceHandle
DeleteService
RegQueryValueExW
OpenProcessToken
DuplicateTokenEx
AllocateAndInitializeSid
GetLengthSid
SetTokenInformation
FreeSid
CreateProcessAsUserW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
QueryServiceStatus
OpenServiceW

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateDirectoryExA
ord155
SHGetFolderLocation
ShellExecuteExW
SHFileOperationW
SHCreateDirectoryExW

ole32

OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitialize
OleUninitialize
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity

oleaut32

CreateErrorInfo
VariantChangeType
VarUI4FromStr
SysFreeString
SysAllocString
VariantInit
VariantClear
SysAllocStringByteLen
VariantCopy
GetErrorInfo
SetErrorInfo

shlwapi

StrStrW
SHCreateStreamOnFileEx
StrStrIW
UrlUnescapeW
ord12
PathFileExistsW

comctl32

InitCommonControlsEx

gdiplus

GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteBrush
GdipDrawString
GdipFillRegion
GdipReleaseDC
GdipCreateRegionRect
GdipFree
GdipCloneBrush
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteRegion
GdipDeleteGraphics
GdiplusStartup
GdipAlloc
GdiplusShutdown

winhttp

WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpen
WinHttpReadData

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses
GetModuleBaseNameW
GetModuleBaseNameA

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 875KB - Virtual size: 874KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

beb8b49f33de836148d6822013c1fa9b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

46:1c:e4:36:56:4e:23:cc:d9:fb:ab:16:de:4b:92:7dCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

eb:65:a0:0b:b9:63:82:da:65:45:0b:6d:d1:b2:62:76:40:62:3d:71Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

winhttp

version

iphlpapi

psapi

wtsapi32

Sections

.text Size: 875KB - Virtual size: 874KB

.rdata Size: 154KB - Virtual size: 153KB

.data Size: 14KB - Virtual size: 26KB

.rsrc Size: 22KB - Virtual size: 22KB

.reloc Size: 44KB - Virtual size: 43KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

46:1c:e4:36:56:4e:23:cc:d9:fb:ab:16:de:4b:92:7d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

eb:65:a0:0b:b9:63:82:da:65:45:0b:6d:d1:b2:62:76:40:62:3d:71
Signer

.text
Size: 875KB - Virtual size: 874KB

.rdata
Size: 154KB - Virtual size: 153KB

.data
Size: 14KB - Virtual size: 26KB

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 44KB - Virtual size: 43KB