Static task
static1
Behavioral task
behavioral1
Sample
2024-05-07_865a2c116652b7856857732c181693ff_mafia_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-07_865a2c116652b7856857732c181693ff_mafia_revil.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-07_865a2c116652b7856857732c181693ff_mafia_revil
-
Size
14.4MB
-
MD5
865a2c116652b7856857732c181693ff
-
SHA1
cf4a02c5a78657d67984b09cccca93ee8d1ddd92
-
SHA256
673aa85cb6448f7169724bce79a7eb418306b97acc4e5fa0f98ad6c6772a7707
-
SHA512
8ea89c29804a469c50e16b4a167a1e7d2c13e3dad2684255edf6f1cc1afe4e5f6dd8eb31673e1151439d26169615f6b7efe8c99e66c839eef56e0d76509b38b1
-
SSDEEP
393216:1VyxYtON/uEoo9VvHO3/M/bZIo07opsu30d2N5cj8gwEYXvx1YHjxvmdqz+GtxAO:1EOtON/uEoo9VvHO3/M/bZIo07opsu30
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-07_865a2c116652b7856857732c181693ff_mafia_revil
Files
-
2024-05-07_865a2c116652b7856857732c181693ff_mafia_revil.exe windows:5 windows x86 arch:x86
91f78529373191f9f03cd2a8a503f2af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadAffinityMask
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
SetConsoleCtrlHandler
CreateFileA
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetThreadPriority
GetFullPathNameA
SignalObjectAndWait
SleepEx
CreateTimerQueue
DeleteTimerQueueTimer
InitializeSListHead
SetEnvironmentVariableA
GetDriveTypeA
GetProcessAffinityMask
GetConsoleMode
GetConsoleCP
LCMapStringW
GetStringTypeW
GetOEMCP
QueryPerformanceCounter
SetHandleCount
GetDateFormatA
GetTimeFormatA
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
GetVersion
CreateFiber
SwitchToFiber
DeleteFiber
InterlockedCompareExchange
SwitchToThread
InterlockedFlushSList
InterlockedPopEntrySList
CreateSemaphoreW
QueryDepthSList
ReleaseSemaphore
InterlockedPushEntrySList
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapQueryInformation
HeapSize
ExitProcess
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
PeekNamedPipe
DecodePointer
EncodePointer
GetFileType
SetStdHandle
GetCPInfo
FindFirstFileExW
GetDriveTypeW
RtlUnwind
GetStartupInfoW
HeapSetInformation
FindResourceExW
GetNumberFormatW
GetWindowsDirectoryW
SearchPathW
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
TlsGetValue
GlobalReAlloc
GetPrivateProfileIntW
ConvertDefaultLocale
GetSystemDefaultUILanguage
CompareStringA
GetLocaleInfoW
LoadLibraryExW
GetFileSizeEx
GetFileAttributesExW
GetProfileIntW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpA
GlobalGetAtomNameW
SuspendThread
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
FlushFileBuffers
lstrcmpiW
GetThreadLocale
ReleaseActCtx
CreateActCtxW
GlobalSize
GetCommandLineW
GlobalAddAtomW
TerminateThread
GetStdHandle
CreateMutexW
SetEvent
VirtualAlloc
VirtualProtect
VirtualFree
GetThreadContext
ReleaseMutex
AttachConsole
FreeConsole
lstrcpynW
CreateEventW
ReadDirectoryChangesW
WaitForMultipleObjects
GetCurrentThread
SetThreadPriority
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
ResumeThread
UnmapViewOfFile
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetCurrentDirectoryW
LocalFileTimeToFileTime
InterlockedIncrement
lstrcpyW
EnumDateFormatsW
EnumTimeFormatsW
WritePrivateProfileStringW
GetPrivateProfileStringW
WritePrivateProfileStructW
GetProcessTimes
InitializeCriticalSection
GetUserDefaultUILanguage
ReplaceFileW
GetFullPathNameW
GetDiskFreeSpaceW
GetFileSize
MulDiv
SetFilePointer
LockFile
UnlockFile
FreeResource
ActivateActCtx
DeactivateActCtx
SetLastError
EnterCriticalSection
LeaveCriticalSection
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
InterlockedExchange
GetEnvironmentVariableW
FormatMessageW
GetSystemInfo
IsProcessorFeaturePresent
GetSystemDirectoryW
GlobalMemoryStatus
TerminateProcess
CreateProcessW
WaitNamedPipeW
GetCurrentThreadId
GetSystemPowerStatus
GetVersionExW
LoadLibraryA
GetACP
LoadLibraryW
FreeLibrary
GetCurrentProcessId
OpenProcess
GetExitCodeThread
GetTickCount
Sleep
CreateWaitableTimerW
SetWaitableTimer
WaitForSingleObject
WriteFile
GlobalFree
GetTimeFormatW
GetUserDefaultLCID
GetDateFormatW
MoveFileW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
IsValidCodePage
lstrlenA
SetCurrentDirectoryW
lstrcmpW
GetTempPathW
GetTempFileNameW
CopyFileW
VirtualQuery
GetModuleFileNameW
DeleteFileW
FindNextFileW
RemoveDirectoryW
CreateDirectoryW
InterlockedDecrement
GetFileAttributesW
OutputDebugStringW
GetFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
SetFileTime
GetFileInformationByHandle
FindFirstFileW
FindClose
CreateFileW
SizeofResource
ReadFile
WideCharToMultiByte
GetCurrentProcess
CloseHandle
LocalAlloc
LocalFree
lstrlenW
GlobalAlloc
GlobalLock
GlobalUnlock
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
CreateTimerQueueTimer
FindFirstFileExA
user32
DestroyAcceleratorTable
MessageBoxIndirectW
DeleteMenu
CallNextHookEx
UnregisterHotKey
RegisterHotKey
LoadBitmapW
AllowSetForegroundWindow
GetWindowTextW
ShowScrollBar
IsRectEmpty
GetMessagePos
DrawFrameControl
HideCaret
GetCaretPos
SetMenuDefaultItem
SetScrollPos
GetComboBoxInfo
InsertMenuW
GetMenuState
RemoveMenu
SetMenuInfo
IsMenu
CascadeWindows
GetClassInfoW
RegisterClassW
LockWindowUpdate
GetSystemMenu
ModifyMenuW
SetClassLongW
SetMenuItemInfoW
DefMDIChildProcW
RegisterClassExW
GetTopWindow
DrawMenuBar
ReleaseCapture
SetCapture
LoadIconW
GetMenu
SetWindowPos
SetParent
GetMenuItemInfoW
PostQuitMessage
ShowOwnedPopups
TrackPopupMenu
IsZoomed
GetDesktopWindow
wsprintfW
LoadCursorW
RedrawWindow
GetSystemMetrics
ShowCaret
MoveWindow
SetWindowLongW
CallWindowProcW
GetCursorPos
ScreenToClient
PtInRect
CharUpperW
PostThreadMessageW
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
GrayStringW
DrawTextExW
SendDlgItemMessageW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
UnhookWindowsHookEx
GetClassLongW
SetClipboardData
CheckDlgButton
CloseClipboard
EmptyClipboard
DrawFocusRect
DrawEdge
IsWindowEnabled
DestroyMenu
LoadMenuW
DestroyCursor
LoadImageW
GetSysColor
FillRect
TrackPopupMenuEx
TrackMouseEvent
GetDlgItemInt
GetWindowLongW
EnableWindow
WindowFromPoint
GetParent
GetNextDlgTabItem
GetActiveWindow
RemovePropW
SetTimer
InvalidateRect
ClientToScreen
FrameRect
WindowFromDC
OffsetRect
InflateRect
CopyRect
DrawStateW
IsCharAlphaW
CopyImage
DrawTextW
DrawIconEx
GetWindowDC
SystemParametersInfoW
GetClientRect
GetWindowRect
SetRect
GetIconInfo
CreateIconIndirect
GetDC
ReleaseDC
EnumClipboardFormats
GetClipboardFormatNameW
GetKeyNameTextW
EnumChildWindows
RegisterWindowMessageW
SendMessageTimeoutW
RegisterClipboardFormatW
SetWindowsHookExW
LoadAcceleratorsW
MessageBoxW
GetScrollBarInfo
IntersectRect
MapWindowPoints
GetSysColorBrush
GetCapture
DefWindowProcW
ValidateRect
BeginPaint
EndPaint
GetLastActivePopup
GetDlgCtrlID
GetWindowPlacement
SetWindowPlacement
SetScrollInfo
GetScrollInfo
EqualRect
AdjustWindowRectEx
GetClassInfoExW
FindWindowW
GetForegroundWindow
EnumWindows
GetWindowThreadProcessId
GetAsyncKeyState
PostMessageW
UpdateWindow
GetMessageExtraInfo
GetKeyState
IsIconic
ShowWindow
CreateWindowExW
GetScrollPos
GetScrollRange
SetScrollRange
SetMenu
ScrollWindow
GetMonitorInfoW
MonitorFromWindow
GetMessageTime
DestroyWindow
GetDlgItem
TabbedTextOutW
GetWindowTextLengthW
OpenClipboard
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
IsCharAlphaNumericW
GetClipboardData
DestroyIcon
GetProcessWindowStation
GetUserObjectInformationW
SetRectEmpty
MsgWaitForMultipleObjects
AnimateWindow
SetLayeredWindowAttributes
SendMessageW
GetSubMenu
EnableMenuItem
GetMenuItemCount
GetMenuItemID
CheckMenuItem
CreatePopupMenu
GetMenuStringW
AppendMenuW
GetGuiResources
CopyAcceleratorTableW
GetClassNameW
SendInput
SetDlgItemInt
SetDlgItemTextW
IsDlgButtonChecked
IsDialogMessageW
SetWindowTextW
ScrollWindowEx
GetDCEx
EndDialog
keybd_event
MapVirtualKeyW
SetForegroundWindow
GetPropW
SetPropW
IsChild
WinHelpW
GetKeyboardState
IsWindow
GetFocus
FindWindowExW
IsWindowVisible
GetWindow
SetFocus
SetActiveWindow
BringWindowToTop
KillTimer
SendDlgItemMessageA
CreateDialogIndirectParamW
TranslateAcceleratorW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
CharNextW
WaitMessage
UnionRect
GetUpdateRect
SetWindowRgn
SetCursorPos
DefFrameProcW
TranslateMDISysAccel
NotifyWinEvent
CopyIcon
MessageBeep
EnableScrollBar
MonitorFromPoint
MapDialogRect
SetWindowContextHelpId
EnumDisplayMonitors
UpdateLayeredWindow
GetMenuDefaultItem
GetDoubleClickTime
UnregisterClassW
RealChildWindowFromPoint
MapVirtualKeyExW
IsCharLowerW
CreateMenu
GetWindowRgn
InvertRect
CharUpperBuffW
CreateAcceleratorTableW
GetKeyboardLayout
ToUnicodeEx
GetNextDlgGroupItem
IsClipboardFormatAvailable
DrawIcon
SubtractRect
InvalidateRgn
SetCursor
gdi32
SelectClipRgn
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetObjectType
CreateHatchBrush
SetRectRgn
CreateEllipticRgn
Ellipse
Polygon
Polyline
EnumFontFamiliesW
GetTextCharsetInfo
CreatePalette
GetPaletteEntries
GetRgnBox
OffsetRgn
GetNearestPaletteIndex
GetSystemPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
GetWindowOrgEx
GetViewportOrgEx
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextFaceW
SetLayout
GetLayout
CreatePolygonRgn
CreateRectRgnIndirect
PatBlt
RoundRect
GetTextColor
CreatePatternBrush
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointW
EnumFontFamiliesExW
CreateFontW
GetDIBColorTable
CreateDIBitmap
SetBkMode
CreateSolidBrush
GetBkColor
CreateDCW
CreateFontIndirectW
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetTextExtentPoint32W
GetTextMetricsW
LPtoDP
GetWindowExtEx
GetViewportExtEx
GetPixel
SetPixel
SetTextColor
SetDIBits
SetDIBColorTable
StretchBlt
Rectangle
GetStockObject
SelectPalette
RealizePalette
CombineRgn
CreateRectRgn
GetCurrentObject
SelectObject
GetObjectW
DPtoLP
CreateBitmap
CreateCompatibleBitmap
GetMapMode
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CopyMetaFileW
PtInRegion
SetMapMode
BitBlt
SetBkColor
CreateCompatibleDC
CreateDIBSection
GetDIBits
DeleteDC
DeleteObject
CreateRoundRectRgn
CreatePen
GetDeviceCaps
msimg32
AlphaBlend
TransparentBlt
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
ClosePrinter
DocumentPropertiesW
advapi32
CryptGenRandom
ReportEventW
DeregisterEventSource
CryptDecrypt
CryptSignHashW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptEnumProvidersW
RegQueryValueW
RegEnumKeyW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
GetSidSubAuthority
GetTokenInformation
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptAcquireContextW
CryptImportKey
CryptCreateHash
CryptSetHashParam
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegQueryValueExW
RegCloseKey
OpenProcessToken
DuplicateToken
MapGenericMask
AccessCheck
GetFileSecurityW
RegOpenKeyExW
RegisterEventSourceW
shell32
DragFinish
ShellExecuteExW
SHGetFileInfoW
DragQueryFileW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
DragAcceptFiles
DuplicateIcon
Shell_NotifyIconW
SHGetDesktopFolder
SHAppBarMessage
SHFileOperationW
SHChangeNotify
SHGetSpecialFolderPathW
SHAddToRecentDocs
ShellExecuteW
comctl32
InitCommonControlsEx
ImageList_GetIconSize
ImageList_Destroy
shlwapi
AssocQueryStringW
PathIsURLW
UrlCreateFromPathW
UrlUnescapeW
ord12
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
windowscodecs
WICConvertBitmapSource
ole32
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRegisterMessageFilter
CoRevokeClassObject
OleLockRunning
OleGetClipboard
StgOpenStorageOnILockBytes
CoGetClassObject
OleInitialize
CoFreeUnusedLibraries
CLSIDFromProgID
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleDuplicateData
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleUninitialize
ReleaseStgMedium
OleRun
CoTaskMemAlloc
CLSIDFromString
CoInitializeSecurity
CoSetProxyBlanket
CoCreateGuid
CoInitializeEx
CoInitialize
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemFree
oleaut32
VariantClear
VariantInit
VarDateFromStr
VarUdateFromDate
SysAllocString
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetLBound
VarBstrFromDate
VariantChangeType
OleCreateFontIndirect
SysAllocStringLen
SysStringByteLen
SysStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
OleLoadPicture
SysAllocStringByteLen
SafeArrayGetUBound
VariantCopy
oledlg
OleUIBusyW
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
wsock32
htonl
accept
htons
ioctlsocket
WSACleanup
WSAStartup
WSAGetLastError
recv
closesocket
send
getsockopt
setsockopt
inet_ntoa
connect
socket
listen
WSAAsyncSelect
recvfrom
sendto
WSASetLastError
bind
select
gdiplus
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipLoadImageFromStream
GdipAlloc
GdipGetImageThumbnail
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipDeleteGraphics
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageBounds
GdipGetImageWidth
GdipFree
wininet
InternetCrackUrlW
InternetCanonicalizeUrlW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
GetUrlCacheEntryInfoW
InternetGetConnectedState
ws2_32
freeaddrinfo
getaddrinfo
winmm
PlaySoundW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
crypt32
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
psapi
GetProcessMemoryInfo
iphlpapi
GetIfTable
GetBestInterface
netapi32
NetWkstaGetInfo
NetApiBufferFree
uxtheme
GetWindowTheme
GetThemeSysColor
SetWindowTheme
IsThemeActive
SetThemeAppProperties
msvfw32
MCIWndCreateW
oleacc
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
imm32
ImmGetContext
ImmReleaseContext
ImmGetOpenStatus
Sections
.text Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 136KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 689KB - Virtual size: 689KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ