2024-04-29_480da02ce4586a3b82b09e2f4f0db4c5_mafia_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-29_480da02ce4586a3b82b09e2f4f0db4c5_mafia_revil
Size 57.7MB
Sample240429-dqefqagd58
SHA256 ea2a03c6315288eccf6e745fb6fce36d7b0a37d50902626dab71aa175ad50f1d
MD5 480da02ce4586a3b82b09e2f4f0db4c5
SHA1 113c070dab7bc58bc776cd3b6e72b66a6f7a3743
SHA512 82bd63753a15e2828759bb735bb4640096fc0837c8ac3045c80a976dc26609147f2c82eefb63ab466d7180fa299d59a4ec2d143c92403d24783cf94b2a5ac940
SSDEEP 1572864:dEXNi/gmvn9gux+ze3OSsmKzxA42riMSxD1:Yg/gUgux+zeD8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-04-29_480da02ce4586a3b82b09e2f4f0db4c5_mafia_revil

.exe 57.7MB

2024-04-29_480da02ce4586a3b82b09e2f4f0db4c5_mafia_revil

IMPHASH 0d96bccf9a8346b90c3639fb88143deb
SHA256 ea2a03c6315288eccf6e745fb6fce36d7b0a37d50902626dab71aa175ad50f1d
MD5 480da02ce4586a3b82b09e2f4f0db4c5
SHA1 113c070dab7bc58bc776cd3b6e72b66a6f7a3743
SHA512 82bd63753a15e2828759bb735bb4640096fc0837c8ac3045c80a976dc26609147f2c82eefb63ab466d7180fa299d59a4ec2d143c92403d24783cf94b2a5ac940
SSDEEP 1572864:dEXNi/gmvn9gux+ze3OSsmKzxA42riMSxD1:Yg/gUgux+zeD8
MD5 SHA1 SHA512 SSDEEP

Digest

22:26:71:6a:12:2e:20:6e:b4:b3:eb:dc:59:d9:5c:9c:eb:76:73:34:60:6a:26:cb:55:11:cb:8a:95:d2:e3:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Apr 25, 2024

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

99:9e:13:43:b7:5a:1b:e8:f0:b1:d8:1f:73:55:b5:27:20:66:7a:ca

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Apr 25, 2024

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

0c:7f:76:dd:c2:e3:c5:f6:77:6f:1f:7c:b3:64:d8:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 27, 2023 - Nov 25, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=202237112N,CN=GearUP Portal Pte. Ltd.,O=GearUP Portal Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

0c:7f:76:dd:c2:e3:c5:f6:77:6f:1f:7c:b3:64:d8:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 27, 2023 - Nov 25, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1099459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\jobs\CHANNEL_GEARUP\workspace\gearup-booster\install\install.pdb

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

InterlockedExchangeAdd IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FlushFileBuffers GetTimeZoneInformation GetFullPathNameA SetStdHandle WriteConsoleW GetStringTypeW SetHandleCount CreateThread GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThreadId GetModuleHandleA GetVersion GetFileAttributesA TlsGetValue TlsSetValue TlsAlloc TlsFree TerminateThread SetThreadPriority GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort QueryPerformanceCounter GetSystemTimeAsFileTime FileTimeToSystemTime QueryPerformanceFrequency FileTimeToLocalFileTime HeapCreate InterlockedExchange IsValidCodePage GetOEMCP GetLocaleInfoW GetSystemDirectoryW IsProcessorFeaturePresent HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW SleepEx GetCPInfo SetConsoleMode ReadConsoleInputA GetFileInformationByHandle FindFirstFileExA GetDriveTypeA SetConsoleCtrlHandler GetConsoleMode GetConsoleCP HeapReAlloc HeapAlloc RtlUnwind GetStartupInfoW HeapSetInformation GetCommandLineW HeapFree ExitThread DecodePointer EncodePointer InterlockedDecrement PeekNamedPipe InterlockedIncrement RaiseException ExpandEnvironmentStringsA InterlockedCompareExchange InitializeCriticalSectionAndSpinCount GetLocalTime GlobalAlloc SetLastError FormatMessageA GlobalLock GlobalUnlock GetFileSize SetFileTime DosDateTimeToFileTime SystemTimeToFileTime ReadFile GetFileSizeEx DuplicateHandle GetFileType SetFilePointer FormatMessageW LocalFree GlobalMemoryStatus LoadLibraryA ExitProcess GetACP GetCurrentDirectoryW FlushConsoleInputBuffer GetCurrentProcessId LoadLibraryW FreeLibrary MulDiv GetDiskFreeSpaceExW GetUserDefaultUILanguage OpenMutexW CreateMutexW CreateFileW WriteFile CreateFileA GetFileAttributesW CreateProcessW GetStdHandle GetModuleFileNameA GetVersionExW GetModuleFileNameW GetCurrentProcess WideCharToMultiByte MultiByteToWideChar VerifyVersionInfoW VerSetConditionMask OutputDebugStringW TerminateProcess Sleep Process32NextW OpenProcess lstrcmpiW Process32FirstW CreateToolhelp32Snapshot WaitForMultipleObjects FindClose FindNextFileW FindFirstFileW CreateDirectoryW DeleteFileW GetTempFileNameW GetTempPathW GetTickCount MoveFileExW CopyFileW WinExec SetEnvironmentVariableA GetExitCodeProcess ResetEvent InitializeCriticalSection FreeResource LockResource SizeofResource CreateEventW WaitForSingleObject SetEvent GetProcAddress DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CloseHandle GetLastError LoadResource FindResourceW OutputDebugStringA GetModuleHandleW SetEndOfFile GetProcessHeap GetDriveTypeW CompareStringW

ws2_32

socket WSACleanup WSAStartup WSAIoctl setsockopt getsockname select getsockopt getpeername connect sendto recvfrom __WSAFDIsSet WSASetLastError send recv WSASetEvent WSAGetLastError ioctlsocket getaddrinfo freeaddrinfo ntohl htons bind listen htonl gethostname closesocket ntohs accept

wldap32

ord26 ord219 ord14 ord118 ord127 ord133 ord145 ord208 ord142 ord79 ord167 ord301 ord27 ord41 ord46 ord216 ord73 ord147

crypt32

CertFreeCertificateChain CertGetCertificateChain CryptQueryObject CertAddCertificateContextToStore CertCreateCertificateChainEngine CertGetNameStringW CertFreeCertificateChainEngine CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryW CertCloseStore CertFreeCertificateContext CertFindCertificateInStore

user32

InvalidateRgn CreateAcceleratorTableW CloseWindow GetUserObjectInformationW GetProcessWindowStation MessageBoxA MsgWaitForMultipleObjectsEx PeekMessageW CallMsgFilterW GetQueueStatus WaitMessage UnregisterClassW MoveWindow GetWindowRgn CharNextW MessageBoxW SetWindowRgn wvsprintfW SetCursor OffsetRect GetClassInfoExW RegisterClassExW LoadCursorW RegisterClassW SetPropW GetPropW CallWindowProcW MonitorFromWindow EnableWindow ShowWindow DefWindowProcW GetMessageW TranslateMessage GetWindowTextW SetWindowTextW GetWindow BeginPaint IsRectEmpty UpdateLayeredWindow EndPaint GetUpdateRect MapWindowPoints CreateWindowExW SetFocus GetFocus DestroyWindow SetWindowPos PostMessageW ReleaseCapture SetCapture InvalidateRect GetWindowLongW SetWindowLongW GetDC IsWindow PostQuitMessage KillTimer SetTimer PtInRect LoadImageW SendMessageW IsZoomed GetClientRect ScreenToClient ReleaseDC EnumDisplaySettingsW GetMonitorInfoW EnumDisplayMonitors GetCursorPos GetKeyState GetWindowRect IsIconic GetSysColor SetCaretPos GetParent GetWindowTextLengthW ShowCaret HideCaret CreateCaret ClientToScreen SetRect CharPrevW DrawTextW FillRect DispatchMessageW IntersectRect

gdi32

GetObjectA GetCharABCWidthsW GetTextExtentPoint32W TextOutW SetBkMode SetTextColor RoundRect CreatePenIndirect MoveToEx LineTo CreateSolidBrush SetBkColor ExtTextOutW SetStretchBltMode StretchBlt CombineRgn GetClipBox CreateRectRgnIndirect ExtSelectClipRgn SelectClipRgn CreateRectRgn PtInRegion CreateRoundRectRgn CreateCompatibleDC CreateDIBSection SaveDC BitBlt RestoreDC Rectangle SetWindowOrgEx DeleteDC CreatePen DeleteObject GetStockObject GetObjectW CreateFontIndirectW SelectObject GetTextMetricsW GetDeviceCaps CreateDCW

advapi32

CryptHashData RegCloseKey RegQueryValueExW OpenSCManagerW CreateServiceW CloseServiceHandle OpenServiceW ControlService CryptImportKey DeleteService RegCreateKeyExW RegSetValueExW RegDeleteValueW DeregisterEventSource ReportEventA CryptEncrypt CryptDestroyKey CryptCreateHash RegisterEventSourceA RegOpenKeyExW CryptGetHashParam CryptDestroyHash CryptAcquireContextW CryptGenRandom CryptReleaseContext

shell32

SHGetMalloc SHBrowseForFolderW SHGetFolderPathW SHGetSpecialFolderLocation ShellExecuteW SHGetPathFromIDListW SHFileOperationW

ole32

CLSIDFromString CLSIDFromProgID OleLockRunning CreateStreamOnHGlobal CoUninitialize CoInitialize CoCreateInstance

shlwapi

PathFileExistsW

gdiplus

GdipCloneImage GdipDrawImageRectRectI GdipDrawImageRectI GdipSetImageAttributesColorMatrix GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImageAttributes GdipCreateImageAttributes GdipCloneBrush GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawString GdipSetTextRenderingHint GdipCreateFromHDC GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateLineBrushI GdiplusStartup GdipDeleteFont GdipDeleteGraphics GdipDeleteStringFormat GdipCreateStringFormat GdipAlloc GdipFree GdipDeleteBrush GdiplusShutdown

comctl32

ord17 _TrackMouseEvent

msimg32

AlphaBlend

winmm

timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-29_480da02ce4586a3b82b09e2f4f0db4c5_mafia_revil

iphlpapi

version

kernel32

ws2_32

wldap32

crypt32

user32

gdi32

advapi32

shell32

ole32

shlwapi

gdiplus

comctl32

msimg32

winmm

generic