2024-05-21_a3dd19240a1567d31afe75013a92c643_mafia_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-21_a3dd19240a1567d31afe75013a92c643_mafia_revil
Size

19.7MB
MD5

a3dd19240a1567d31afe75013a92c643
SHA1

ad347417c2d6d19f1bc37227b271e389ce025979
SHA256

c8df693b0894c18032ac46f1819066e4363473422a1fa9eb324350e787d17e97
SHA512

f6dc124b4681028270f5c0d05fd47ef26100f34a2700f30365177de1194bf46b7b0bd5d121031791d948f589c6dd3772392949509c211bb37c4eb8a520bffda6
SSDEEP

393216:RKrn0VM2JORK3pYJsv6tWKFdu9CUUGkFlU7:80N5WGOa7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-21_a3dd19240a1567d31afe75013a92c643_mafia_revil

Files

2024-05-21_a3dd19240a1567d31afe75013a92c643_mafia_revil
.exe windows:5 windows x86 arch:x86

ff7b25e0c0098fea8cb29879105992b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Tools_git_priv\RogueKillerPE\Release\RogueKillerPE.pdb

Imports

kernel32

SetConsoleCtrlHandler
FindFirstFileExA
SetHandleCount
GetDriveTypeA
FileTimeToLocalFileTime
WriteConsoleW
FatalAppExitA
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableW
SetEnvironmentVariableA
GetACP
SetStdHandle
GetOEMCP
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
CreateProcessA
lstrlenA
SetFileAttributesA
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsProcessorFeaturePresent
IsDebuggerPresent
GetConsoleMode
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleCP
ExitThread
HeapSetInformation
LCMapStringW
GetCommandLineA
RaiseException
GetNumberOfConsoleInputEvents
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
GlobalFree
LoadLibraryExW
FlushConsoleInputBuffer
FindFirstFileA
FindNextFileA
PeekConsoleInputA
FindCloseChangeNotification
FindFirstChangeNotificationW
GlobalMemoryStatus
GetVersion
ExpandEnvironmentStringsA
PeekNamedPipe
VerifyVersionInfoA
SleepEx
GetVolumeNameForVolumeMountPointW
lstrcmpiW
lstrlenW
IsBadWritePtr
GetVolumePathNameW
WaitForMultipleObjectsEx
GetCompressedFileSizeW
IsBadReadPtr
VirtualQueryEx
SuspendThread
GetCurrentDirectoryA
GetModuleFileNameA
GetEnvironmentVariableA
GetThreadContext
GetEnvironmentVariableW
DeleteFileA
AreFileApisANSI
GetTempPathA
GetVersionExA
OutputDebugStringA
GetDiskFreeSpaceA
CreateFileMappingA
LockFileEx
HeapSize
HeapValidate
SetConsoleMode
GetFileAttributesA
HeapDestroy
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
LockFile
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
HeapFree
HeapAlloc
TryEnterCriticalSection
HeapCompact
CreateFileA
HeapReAlloc
GetFullPathNameA
LockResource
FindNextChangeNotification
SetHandleInformation
CreatePipe
CreateDirectoryA
RemoveDirectoryA
GetTimeFormatA
GetDateFormatA
OpenProcess
CreateFileW
SizeofResource
LoadResource
FindResourceW
lstrcpyW
LocalAlloc
lstrcmpA
GetDiskFreeSpaceExW
QueryDosDeviceW
CreateMutexA
GetComputerNameW
GetThreadLocale
SetThreadLocale
GetShortPathNameW
Module32NextW
Module32FirstW
CreateRemoteThread
SetFileAttributesW
GetDiskFreeSpaceW
SetFilePointer
GetFileSize
TzSpecificLocalTimeToSystemTime
CompareFileTime
SystemTimeToFileTime
BackupRead
BackupSeek
GetConsoleScreenBufferInfo
OpenMutexW
GetStdHandle
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetPriorityClass
GetTempFileNameW
WriteProcessMemory
TerminateJobObject
CreateToolhelp32Snapshot
Process32NextW
OpenThread
Process32FirstW
SetLastError
Thread32Next
TerminateProcess
GetExitCodeProcess
ReadProcessMemory
AssignProcessToJobObject
Thread32First
GetProcessTimes
CreateJobObjectW
SetThreadContext
GetFileSizeEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
ReleaseMutex
CreateMutexW
InterlockedDecrement
InterlockedIncrement
HeapCreate
ReadConsoleInputA
CompareStringW
GetUserDefaultLCID
GetCurrentProcessId
LocalFree
GetCommandLineW
GetConsoleWindow
OutputDebugStringW
TlsFree
TlsSetValue
GetCurrentThreadId
GetSystemInfo
SwitchToThread
Sleep
SetThreadPriority
GetCurrentThread
TlsAlloc
TerminateThread
WaitForSingleObject
TlsGetValue
GetLastError
WaitForMultipleObjects
ResumeThread
GetThreadPriority
SetEvent
CreateThread
CreateEventW
DuplicateHandle
GetCurrentProcess
GetProcAddress
VerifyVersionInfoW
GetVersionExW
GetNativeSystemInfo
FormatMessageW
WaitForSingleObjectEx
QueryPerformanceFrequency
GetModuleHandleW
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
GetModuleFileNameW
GetLocalTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileInformationByHandle
SetErrorMode
FindClose
FindFirstFileW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
CopyFileW
MoveFileW
DeleteFileW
LoadLibraryW
DeviceIoControl
GetFullPathNameW
GetLongPathNameW
GetTempPathW
GetCurrentDirectoryW
GetLogicalDrives
GetFileAttributesExW
SetCurrentDirectoryW
ResetEvent
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
GetFileType
SetFilePointerEx
ReadFile
WriteFile
MoveFileExW
SetEndOfFile
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FreeLibrary
FindNextFileW
FindFirstFileExW
GetGeoInfoW
GetUserGeoID
GetTimeZoneInformation
LoadLibraryA
GetModuleHandleA
ExitProcess
GetVolumeInformationW
GetDriveTypeW
lstrcmpW
IsValidLocale
IsValidLanguageGroup
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetUserDefaultLangID
ExpandEnvironmentStringsW
CreateProcessW
CheckRemoteDebuggerPresent
CloseHandle

user32

ReleaseDC
GetDC
DestroyIcon
CreateIconFromResource
GetIconInfo
DrawIconEx
SendMessageA
FindWindowA
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
LoadStringW
FindWindowW
ExitWindowsEx
FindWindowExW
PostThreadMessageW
EnumWindows
RealGetWindowClassW
GetWindowTextW
GetCursor
CreateCursor
CreateIconIndirect
SetCursorPos
GetCursorInfo
GetMessageExtraInfo
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
NotifyWinEvent
LoadCursorW
GetAsyncKeyState
DestroyCursor
SetClipboardViewer
GetWindowThreadProcessId
ChangeClipboardChain
UnregisterClassW
SetTimer
KillTimer
PeekMessageW
UnhookWindowsHookEx
DestroyWindow
CallNextHookEx
PostMessageW
GetQueueStatus
SetWindowsHookExW
DefWindowProcW
GetWindowLongW
RegisterClassW
SetWindowLongW
CreateWindowExW
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjectsEx
CharNextExA
MessageBoxW
SystemParametersInfoW
GetSystemMenu
EnableMenuItem
GetSysColor
GetSystemMetrics
SetWindowRgn
MessageBeep
GetDoubleClickTime
GetCaretBlinkTime
ScreenToClient
GetClientRect
GetKeyboardLayoutList
GetParent
ChildWindowFromPointEx
GetFocus
GetCursorPos
ClientToScreen
RegisterClassExW
LoadImageW
GetClassInfoW
GetSysColorBrush
GetCapture
GetDesktopWindow
GetAncestor
IsWindowVisible
IsChild
GetForegroundWindow
ReleaseCapture
SetCursor
FlashWindowEx
SendMessageW
InvalidateRect
SetWindowPos
ShowWindow
GetWindowRect
GetWindowPlacement
AdjustWindowRectEx
SetWindowTextW
SetFocus
SetForegroundWindow
SetCapture
EndPaint
BeginPaint
GetUpdateRect
SetParent
MoveWindow
SetWindowPlacement
IsIconic
RegisterClipboardFormatW
GetClipboardFormatNameW
ToUnicode
GetKeyboardLayout
GetKeyState
TrackPopupMenuEx
SetMenuItemInfoW
IsZoomed
MapVirtualKeyW
GetKeyboardState
GetMenu
ToAscii
LoadIconW
SetCaretPos
RegisterWindowMessageW
DestroyCaret
HideCaret
CreateCaret

gdi32

GetStockObject
OffsetRgn
GetDeviceCaps
BitBlt
SelectClipRgn
GetRegionData
GdiFlush
CreateRectRgn
CombineRgn
ChoosePixelFormat
SwapBuffers
DescribePixelFormat
GetPixelFormat
GetBitmapBits
CreateDCW
GetOutlineTextMetricsW
GetGlyphOutlineW
GetTextExtentPoint32W
GetFontData
SetGraphicsMode
GetCharABCWidthsFloatW
GetCharABCWidthsI
GetCharABCWidthsW
ExtTextOutW
SetTextAlign
SetBkMode
SetTextColor
GetTextFaceW
GetObjectA
CreateBitmap
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
GetDIBits
CreateFontIndirectW
EnumFontFamiliesExW
GetObjectW
RemoveFontMemResourceEx
RemoveFontResourceExW
AddFontResourceExW
GetTextMetricsW
AddFontMemResourceEx
SetWorldTransform
SetPixelFormat
CreateCompatibleBitmap

dbghelp

MiniDumpWriteDump

opengl32

glCopyTexSubImage2D
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glCopyTexImage2D
glDrawArrays
glDrawElements
glEnable
glFinish
glFlush
glTexSubImage2D
glViewport
glDepthRange
glClearDepth
glColorMask
glClearStencil
glClearColor
glClear
glBlendFunc
glBindTexture
glDisable
glFrontFace
glGenTextures
glGetBooleanv
glGetError
glGetFloatv
glGetIntegerv
glGetString
glGetTexParameterfv
glGetTexParameteriv
glHint
glIsEnabled
glIsTexture
glLineWidth
glPixelStorei
glPolygonOffset
glTexParameteriv
glTexParameteri
glTexParameterfv
glTexParameterf
glTexImage2D
glStencilOp
glStencilMask
glStencilFunc
glScissor
glReadPixels

ntdll

_CIsin
floor
bsearch
VerSetConditionMask
_aulldiv
strncpy
memchr
_aulldvrm
strrchr
_allshl
strchr
strncmp
_chkstk
memset
strtoul
_alldiv
_fltused
memmove
memcpy
isalpha
strpbrk
NtQueryVirtualMemory
_CIcos
strcmp
isupper
islower
isgraph
_snprintf
strtol
wcsncmp
wcsrchr
_CIlog
sscanf
sprintf
isspace
toupper
qsort
_wcsicmp
tolower
_wtoi64
strcspn
isalnum
wcsstr
NtQueryKey
NtOpenKey
strspn
_CIpow
NtDeleteValueKey
NtCreateKey
NtSetValueKey
NtDeleteKey
_vsnprintf
RtlUnwind
atoi
_strnicmp
_stricmp
isxdigit
wcstombs
_vsnwprintf
strstr
isdigit
_atoi64
_allshr
_allrem
isprint
NtUnloadDriver
NtQuerySystemInformation
RtlInitUnicodeString
_aullshr
NtLoadDriver
ceil
_aullrem
_allmul
_CIsqrt

advapi32

GetExplicitEntriesFromAclW
SetSecurityDescriptorDacl
LookupPrivilegeValueW
SetKernelObjectSecurity
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetSecurityInfo
SetEntriesInAclW
IsValidSecurityDescriptor
CheckTokenMembership
AdjustTokenPrivileges
RegRestoreKeyW
RegSaveKeyExW
RegLoadKeyW
RegUnLoadKeyW
GetUserNameW
GetAclInformation
RegisterEventSourceA
ReportEventA
QueryServiceConfigW
ReportEventW
RegisterServiceCtrlHandlerW
EnumServicesStatusW
SetServiceStatus
ChangeServiceConfigW
QueryServiceStatus
ChangeServiceConfig2W
QueryServiceConfig2W
EnumDependentServicesW
StartServiceCtrlDispatcherW
RegisterEventSourceW
ControlService
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
DeregisterEventSource
CryptGenRandom
LookupPrivilegeValueA
GetUserNameA
ConvertSidToStringSidW
GetInheritanceSourceW
RegSetKeySecurity
IsValidSid
GetNamedSecurityInfoW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegFlushKey
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
FreeInheritedFromArray
OpenProcessToken
GetTokenInformation
GetLengthSid
InitializeSecurityDescriptor
CopySid
FreeSid
ConvertStringSidToSidW
SetNamedSecurityInfoW
RegGetKeySecurity

wininet

InternetGetConnectedState
InternetCrackUrlW

psapi

GetModuleInformation
GetModuleFileNameExW
GetProcessImageFileNameW
GetModuleBaseNameW
GetMappedFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoA

wsock32

listen
accept
recvfrom
sendto
gethostbyname
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
inet_ntoa
setsockopt
inet_addr
ntohl
htonl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
WSAAsyncSelect
shutdown
gethostname
getsockname

userenv

GetProfilesDirectoryW

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertNameToStrW
CryptDecodeObject
CryptMsgClose
CryptMsgGetParam

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash

shlwapi

PathFileExistsW
PathIsRootW
PathCompactPathW
PathSearchAndQualifyW
PathAppendW
PathCommonPrefixW
PathIsLFNFileSpecW
PathRenameExtensionW
PathUnquoteSpacesW
PathRemoveBlanksW
PathQuoteSpacesW
PathIsDirectoryEmptyW
PathFindNextComponentW
PathRemoveArgsW
AssocQueryStringW
PathMakePrettyW
PathIsURLW
PathGetDriveNumberW
PathAddBackslashW
PathCanonicalizeW
PathRemoveFileSpecW
PathIsSameRootW
StrCmpIW
StrDupW
StrCmpNIW
PathFindFileNameW
PathIsRelativeW
PathGetArgsW
PathFindExtensionW
PathIsDirectoryW
PathUnExpandEnvStringsW
PathBuildRootW
PathIsPrefixW
PathRemoveExtensionW
PathIsNetworkPathW
PathIsUNCW
PathRemoveBackslashW
StrFormatByteSizeW

winhttp

WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpWriteData
WinHttpReadData
WinHttpSendRequest
WinHttpSetOption
WinHttpReceiveResponse

iphlpapi

GetAdaptersAddresses

shell32

SHBrowseForFolderW
SHGetMalloc
ShellExecuteExW
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
ord68
SHGetSpecialFolderLocation
SHGetPathFromIDListW
CommandLineToArgvW
SHChangeNotify

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemAlloc
CoGetMalloc
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
ReleaseStgMedium
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid

ws2_32

WSAAddressToStringW
WSAIoctl

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantClear
SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString

imm32

ImmAssociateContext
ImmGetCompositionStringW
ImmGetDefaultIMEWnd
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey
ImmGetContext
ImmNotifyIME
ImmReleaseContext

winmm

PlaySoundW

Exports

Exports

ud_decode
ud_disassemble
ud_get_user_opaque_data
ud_init
ud_input_end
ud_input_skip
ud_insn_asm
ud_insn_hex
ud_insn_len
ud_insn_mnemonic
ud_insn_off
ud_insn_opr
ud_insn_ptr
ud_lookup_mnemonic
ud_opr_is_gpr
ud_opr_is_sreg
ud_set_asm_buffer
ud_set_input_buffer
ud_set_input_file
ud_set_input_hook
ud_set_mode
ud_set_pc
ud_set_sym_resolver
ud_set_syntax
ud_set_user_opaque_data
ud_set_vendor
ud_translate_intel
yr_compiler_add_file
yr_compiler_add_string
yr_compiler_create
yr_compiler_define_boolean_variable
yr_compiler_define_float_variable
yr_compiler_define_integer_variable
yr_compiler_define_string_variable
yr_compiler_destroy
yr_compiler_get_current_file_name
yr_compiler_get_error_message
yr_compiler_get_rules
yr_compiler_set_callback
yr_filemap_map
yr_filemap_map_ex
yr_filemap_map_fd
yr_filemap_unmap
yr_finalize
yr_finalize_thread
yr_get_tidx
yr_initialize
yr_rules_define_boolean_variable
yr_rules_define_float_variable
yr_rules_define_integer_variable
yr_rules_define_string_variable
yr_rules_destroy
yr_rules_load
yr_rules_load_stream
yr_rules_save
yr_rules_save_stream
yr_rules_scan_fd
yr_rules_scan_file
yr_rules_scan_mem
yr_rules_scan_mem_blocks
yr_rules_scan_proc
yr_set_tidx
z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 13.1MB - Virtual size: 13.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 242KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff7b25e0c0098fea8cb29879105992b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

dbghelp

opengl32

ntdll

advapi32

wininet

psapi

version

wsock32

userenv

crypt32

wintrust

shlwapi

winhttp

iphlpapi

shell32

ole32

ws2_32

oleaut32

imm32

winmm

Exports

Exports

Sections

.text Size: 13.1MB - Virtual size: 13.1MB

.rdata Size: 3.8MB - Virtual size: 3.8MB

.data Size: 242KB - Virtual size: 290KB

.qtmetad Size: 1024B - Virtual size: 588B

.rsrc Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 482KB - Virtual size: 481KB

.text
Size: 13.1MB - Virtual size: 13.1MB

.rdata
Size: 3.8MB - Virtual size: 3.8MB

.data
Size: 242KB - Virtual size: 290KB

.qtmetad
Size: 1024B - Virtual size: 588B

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 482KB - Virtual size: 481KB