2024-04-28_3edb2e8d0187a8c9918f96617e2f3226_floxif_mafia_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-28_3edb2e8d0187a8c9918f96617e2f3226_floxif_mafia_revil
Size

14.1MB
MD5

3edb2e8d0187a8c9918f96617e2f3226
SHA1

ca2826ec6041a144a83fd0a5edeff1e6d1b7050d
SHA256

e7241ce6ca0c0ace761287a24fd63a9050b92cd7f97d93fd9b383990848cbe99
SHA512

acec0ba7f6fa34ddf1dc94208a11dc96106c1dadb922ebe288eefd49c5edf15c78c58364f09e31b47ddca7476a0a645dc3acae2a82fcee63acfc1b22211c46b8
SSDEEP

196608:5rEc7/E12NHmU2HtPAsMNckhVFOL0EbtoXVXVryK:5YC/EKDSKckhVBVXVF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-28_3edb2e8d0187a8c9918f96617e2f3226_floxif_mafia_revil

Files

2024-04-28_3edb2e8d0187a8c9918f96617e2f3226_floxif_mafia_revil
.exe windows:5 windows x86 arch:x86

be5becf3326ad94196b40811e994c802

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DeregisterEventSource
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegisterEventSourceA
ReportEventA

bass

BASS_ChannelBytes2Seconds
BASS_ChannelFlags
BASS_ChannelGetAttribute
BASS_ChannelGetInfo
BASS_ChannelGetLength
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelIsActive
BASS_ChannelPlay
BASS_ChannelSeconds2Bytes
BASS_ChannelSetAttribute
BASS_ChannelSetPosition
BASS_ChannelStop
BASS_ErrorGetCode
BASS_Free
BASS_GetDeviceInfo
BASS_GetInfo
BASS_Init
BASS_MusicFree
BASS_MusicLoad
BASS_Pause
BASS_SampleFree
BASS_SampleGetChannel
BASS_SampleGetChannels
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SetConfig
BASS_Start
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamFree
BASS_StreamPutData
BASS_Update

comctl32

_TrackMouseEvent

comdlg32

GetOpenFileNameA
GetSaveFileNameA

d3d9

Direct3DCreate9

gdi32

AddFontResourceExA
DeleteObject
GetStockObject
RemoveFontResourceA

kernel32

CloseHandle
CompareStringW
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreatePipe
CreateProcessA
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileA
EncodePointer
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileExA
FindNextFileA
FlushConsoleInputBuffer
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatA
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultUILanguage
GetVersion
GetVersionExA
GlobalAlloc
GlobalLock
GlobalMemoryStatus
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileA
MultiByteToWideChar
OutputDebugStringA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleInputA
ReadFile
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpi

ole32

CoCreateInstance
CoInitialize
CoUninitialize

shell32

DragQueryFile
SHGetSpecialFolderPathA
ShellExecuteA

user32

ChangeDisplaySettingsA
ClientToScreen
CloseClipboard
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyWindow
DispatchMessageA
EmptyClipboard
EnumDisplaySettingsA
FindWindowA
GetActiveWindow
GetAsyncKeyState
GetClientRect
GetClipboardData
GetCursor
GetCursorPos
GetForegroundWindow
GetKeyState
GetMonitorInfoA
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowLongA
GetWindowRect
IsClipboardFormatAvailable
IsIconic
LoadCursorA
LoadCursorFromFileA
LoadIconA
MessageBoxA
MessageBoxW
MonitorFromWindow
OpenClipboard
PeekMessageA
PostMessageA
RegisterClassExW
ReleaseCapture
ScreenToClient
SetCapture
SetClipboardData
SetCursor
SetForegroundWindow
SetWindowLongA
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoA
TranslateMessage
UpdateWindow

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

wldap32

ber_free
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfreeA
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_unbind_s
ldap_value_free_len

ws2_32

FreeAddrInfoW
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htons
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1004KB - Virtual size: 1004KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text1
Size: 768KB - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc1
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Geddon
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

be5becf3326ad94196b40811e994c802

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bass

comctl32

comdlg32

d3d9

gdi32

kernel32

ole32

shell32

user32

winmm

wldap32

ws2_32

wtsapi32

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 1004KB - Virtual size: 1004KB

.data Size: 3.7MB - Virtual size: 3.7MB

.reloc Size: 308KB - Virtual size: 308KB

.text1 Size: 768KB - Virtual size: 768KB

.adata Size: 64KB - Virtual size: 64KB

.data1 Size: 192KB - Virtual size: 192KB

.reloc1 Size: 64KB - Virtual size: 64KB

.pdata Size: 3.2MB - Virtual size: 3.2MB

.rsrc Size: 364KB - Virtual size: 364KB

.Geddon Size: 8KB - Virtual size: 8KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 1004KB - Virtual size: 1004KB

.data
Size: 3.7MB - Virtual size: 3.7MB

.reloc
Size: 308KB - Virtual size: 308KB

.text1
Size: 768KB - Virtual size: 768KB

.adata
Size: 64KB - Virtual size: 64KB

.data1
Size: 192KB - Virtual size: 192KB

.reloc1
Size: 64KB - Virtual size: 64KB

.pdata
Size: 3.2MB - Virtual size: 3.2MB

.rsrc
Size: 364KB - Virtual size: 364KB

.Geddon
Size: 8KB - Virtual size: 8KB