2024-05-26_4bc9027ea9b00946983e557e26e5140b_mafia_revil_skypams

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-26_4bc9027ea9b00946983e557e26e5140b_mafia_revil_skypams
Size

11.7MB
MD5

4bc9027ea9b00946983e557e26e5140b
SHA1

f7d8e8e1700d60053a5aaf453e2e53c5a5096db0
SHA256

6a17767a1562a7c68106b46430988a8766d390ec0de5810149baceb21c3181e2
SHA512

bcffad29ccfc33812e8eb31e2b348573dc779377a6c5b899463264a179708b99dda463e6eee4b810eee5157686afa98c5db705ca57dd018178f3ad62e642d8dd
SSDEEP

196608:sxn6iHY0732z6brs8AejHFCke5XrsRk1uUOCS9vOKgwLQUxF2tQiQSnbGb9bOS:M6iHY0732z6brs3eDFCke5XQR8uUOb9B

Score

1^/10

Malware Config

Signatures

Files

2024-05-26_4bc9027ea9b00946983e557e26e5140b_mafia_revil_skypams
.exe windows:5 windows x86 arch:x86

ed2f00f06e985f5297c326dd8ed9879c

Code Sign

07:30:c2:48:97:78:13:c2:5b:b2:25:68:b5:1e:d2:87
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/03/2015, 00:00

Not After

28/06/2018, 12:00

Subject

CN=Adlice,O=Adlice,L=Orvault,ST=Loire Atlantique,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:c3:97:62:b2:d0:23:41:a6:9b:4b:29:dd:a9:f8:5a:1d:ef:7c:33
Signer

Actual PE Digest

0a:c3:97:62:b2:d0:23:41:a6:9b:4b:29:dd:a9:f8:5a:1d:ef:7c:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Adlice\RogueKillerQt\Release\RogueKiller.pdb

Imports

ntdll

RtlUnwind
atoi
islower
isgraph
isupper
_stricmp
_atoi64
_allrem
_allshr
isprint
strpbrk
strstr
strtol
_alldiv
_CIlog
_CIpow
_strnicmp
strcmp
_vsnprintf
NtUnloadDriver
RtlInitUnicodeString
NtLoadDriver
sscanf
strrchr
strtoul
wcstombs
_aulldvrm
_allshl
_allmul
_aullrem
_aulldiv
strncpy
isxdigit
isdigit
_chkstk
_vsnwprintf
sprintf
isalpha
_aullshr
strncmp
qsort
memset
_snprintf
memcpy
VerSetConditionMask
strchr
NtDeleteKey
NtSetValueKey
NtDeleteValueKey
NtOpenKey
NtQueryKey
wcsstr
isalnum
strcspn
toupper
_wtoi64
tolower
memchr
isspace
_wcsicmp
NtQueryVirtualMemory
memmove
NtQuerySystemInformation
floor
strspn
_alldvrm

advapi32

QueryServiceConfig2W
RegQueryValueExW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatus
EnumServicesStatusW
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueW
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetEntriesInAclW
FreeSid
IsValidSecurityDescriptor
CheckTokenMembership
AdjustTokenPrivileges
ControlService
QueryServiceConfigW
RegisterEventSourceA
RegCreateKeyExW
ReportEventA
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
DeregisterEventSource
OpenServiceW
RegEnumKeyExW
RegLoadKeyW
RegCloseKey
RegSetValueExW
RegUnLoadKeyW
GetUserNameW
EnumDependentServicesW
ConvertStringSidToSidW
LookupAccountNameW
LookupPrivilegeValueA
ConvertSidToStringSidW
GetExplicitEntriesFromAclW
FreeInheritedFromArray
SetNamedSecurityInfoW
RegGetKeySecurity
GetNamedSecurityInfoW
IsValidSid
RegSetKeySecurity
GetInheritanceSourceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW

kernel32

EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
GetStringTypeW
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
ExitProcess
WaitForSingleObject
SetEvent
TerminateThread
CloseHandle
ResetEvent
CreateEventW
GetModuleHandleW
GetGeoInfoW
GetUserGeoID
GetLocaleInfoW
SetThreadLocale
GetThreadLocale
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
LoadLibraryW
Sleep
GetCurrentThreadId
FindResourceW
LoadResource
SizeofResource
GetLastError
LockResource
CreateMutexW
SetErrorMode
GetCurrentProcess
GetComputerNameW
OpenProcess
GetSystemDirectoryW
FormatMessageW
GetModuleFileNameW
GetCurrentDirectoryW
GetProcAddress
ReleaseMutex
LocalFree
GetVolumeInformationW
CreateThread
GetFileSize
FindFirstFileW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
MoveFileExW
CreateDirectoryW
WriteFile
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
GetLongPathNameW
SetLastError
MoveFileW
GetDiskFreeSpaceW
FindClose
CreateFileMappingW
RemoveDirectoryW
DeviceIoControl
FindNextFileW
GetFileAttributesExW
DeleteFileW
SetFileAttributesW
FileTimeToLocalFileTime
GetTempPathW
GetCurrentProcessId
GetCommandLineW
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
CompareFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetSystemTime
GetFullPathNameW
GetShortPathNameW
GetVersionExW
CreateProcessW
CreateJobObjectW
GetProcessTimes
Thread32First
AssignProcessToJobObject
ReadProcessMemory
GetExitCodeProcess
TerminateProcess
Thread32Next
Process32FirstW
OpenThread
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
TerminateJobObject
WriteProcessMemory
GetConsoleMode
SetConsoleMode
WriteConsoleW
GetStdHandle
GetDriveTypeW
QueryDosDeviceW
GetDiskFreeSpaceExW
lstrcmpA
LocalAlloc
lstrcpyW
OutputDebugStringA
GetVersionExA
SuspendThread
GetFullPathNameA
HeapReAlloc
CreateFileA
HeapCompact
TryEnterCriticalSection
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
FlushFileBuffers
HeapSize
LockFileEx
EnterCriticalSection
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
DeleteCriticalSection
GetTempPathA
AreFileApisANSI
DeleteFileA
InterlockedDecrement
CreateRemoteThread
Module32FirstW
Module32NextW
GetFileSizeEx
SetFilePointerEx
VirtualFree
IsBadReadPtr
GetCompressedFileSizeW
WaitForMultipleObjectsEx
GetVolumePathNameW
IsBadWritePtr
lstrlenW
VirtualAlloc
GetFileType
lstrcmpiW
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
SwitchToThread
InterlockedIncrement
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetVersion
SleepEx
VerifyVersionInfoA
CreateMutexA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
VirtualQueryEx
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GlobalMemoryStatus
InterlockedExchange
FlushConsoleInputBuffer
RaiseException
LoadLibraryExW
GlobalAlloc
GlobalFree
GetDriveTypeA
FindFirstFileExA
SetConsoleCtrlHandler
ReadConsoleInputA
LCMapStringW
CompareStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
VirtualQuery
GetTimeZoneInformation
SetStdHandle
IsProcessorFeaturePresent
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
BackupSeek
BackupRead
ExpandEnvironmentStringsW

user32

GetWindowTextW
InvalidateRect
TrackPopupMenuEx
LoadIconW
RegisterClassExW
TranslateMessage
GetDC
TrackMouseEvent
GetSubMenu
GetMessageW
TranslateAcceleratorW
GetWindowTextLengthW
PostQuitMessage
GetWindowRect
MessageBoxW
SetCursor
EndPaint
LoadStringW
DispatchMessageW
DestroyIcon
SetWindowTextW
DestroyMenu
EnableWindow
UpdateWindow
CreateWindowExW
GetCursorPos
SetWindowPos
GetDesktopWindow
SendMessageA
FindWindowA
MessageBoxA
LoadImageW
LoadCursorW
BeginPaint
PtInRect
LoadAcceleratorsW
LoadMenuW
GetWindowLongW
SetWindowLongW
ShowWindow
SetMenu
GetProcessWindowStation
GetUserObjectInformationW
EnumWindows
GetWindowThreadProcessId
ReleaseDC
DestroyWindow
ExitWindowsEx
SystemParametersInfoW
SendMessageW
PostThreadMessageW
GetSystemMetrics
CallWindowProcW
DefWindowProcW
MoveWindow
GetClientRect
RedrawWindow

gdi32

SetTextColor
DeleteObject
CreateFontW
GetStockObject

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID

oleaut32

VariantClear
SysFreeString
VariantInit
SysStringLen
SysAllocString

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wsock32

listen
accept
recvfrom
sendto
gethostbyname
connect
socket
closesocket
getpeername
getsockopt
htons
inet_ntoa
ntohs
getsockname
setsockopt
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
gethostname
bind
shutdown

ws2_32

WSAIoctl

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertNameToStrW
CryptDecodeObject

wintrust

CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
WinVerifyTrust

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
GetModuleBaseNameW
GetMappedFileNameW

userenv

GetProfilesDirectoryW

comctl32

InitCommonControlsEx
ImageList_Destroy
ImageList_ReplaceIcon
ord413
ImageList_SetOverlayImage
ord410
ImageList_Create

wininet

InternetCrackUrlW

winhttp

WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData

shlwapi

PathGetArgsW
PathIsRelativeW
PathFindFileNameW
PathCanonicalizeW
PathFindExtensionW
PathGetDriveNumberW
PathRemoveBlanksW
PathFileExistsW
PathIsRootW
PathCompactPathW
PathSearchAndQualifyW
PathIsDirectoryW
PathUnExpandEnvStringsW
PathIsPrefixW
PathRemoveExtensionW
PathIsNetworkPathW
AssocQueryStringW
PathAppendW
PathCommonPrefixW
PathAddBackslashW
PathUnquoteSpacesW
PathQuoteSpacesW
PathRemoveArgsW
PathMakePrettyW
StrCmpIW
StrDupW
StrCmpNIW

Exports

Exports

ud_decode
ud_disassemble
ud_get_user_opaque_data
ud_init
ud_input_end
ud_input_skip
ud_insn_asm
ud_insn_hex
ud_insn_len
ud_insn_mnemonic
ud_insn_off
ud_insn_opr
ud_insn_ptr
ud_lookup_mnemonic
ud_opr_is_gpr
ud_opr_is_sreg
ud_set_asm_buffer
ud_set_input_buffer
ud_set_input_file
ud_set_input_hook
ud_set_mode
ud_set_pc
ud_set_sym_resolver
ud_set_syntax
ud_set_user_opaque_data
ud_set_vendor
ud_translate_intel
yr_compiler_add_file
yr_compiler_add_string
yr_compiler_create
yr_compiler_define_boolean_variable
yr_compiler_define_float_variable
yr_compiler_define_integer_variable
yr_compiler_define_string_variable
yr_compiler_destroy
yr_compiler_get_current_file_name
yr_compiler_get_error_message
yr_compiler_get_rules
yr_compiler_set_callback
yr_filemap_map
yr_filemap_map_ex
yr_filemap_map_fd
yr_filemap_unmap
yr_filemap_unmap_fd
yr_finalize
yr_finalize_thread
yr_get_configuration
yr_get_tidx
yr_hash_table_add
yr_hash_table_add_raw_key
yr_hash_table_clean
yr_hash_table_create
yr_hash_table_destroy
yr_hash_table_lookup
yr_hash_table_lookup_raw_key
yr_initialize
yr_object_print_data
yr_rules_define_boolean_variable
yr_rules_define_float_variable
yr_rules_define_integer_variable
yr_rules_define_string_variable
yr_rules_destroy
yr_rules_load
yr_rules_load_stream
yr_rules_save
yr_rules_save_stream
yr_rules_scan_fd
yr_rules_scan_file
yr_rules_scan_mem
yr_rules_scan_mem_blocks
yr_rules_scan_proc
yr_set_configuration
yr_set_tidx

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 810KB - Virtual size: 809KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 170KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed2f00f06e985f5297c326dd8ed9879c

Code Sign

07:30:c2:48:97:78:13:c2:5b:b2:25:68:b5:1e:d2:87Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

0a:c3:97:62:b2:d0:23:41:a6:9b:4b:29:dd:a9:f8:5a:1d:ef:7c:33Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

advapi32

kernel32

user32

gdi32

shell32

ole32

oleaut32

version

wsock32

ws2_32

crypt32

wintrust

psapi

userenv

comctl32

wininet

winhttp

shlwapi

Exports

Exports

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 810KB - Virtual size: 809KB

.data Size: 170KB - Virtual size: 226KB

.rsrc Size: 6.8MB - Virtual size: 6.8MB

.reloc Size: 280KB - Virtual size: 280KB

07:30:c2:48:97:78:13:c2:5b:b2:25:68:b5:1e:d2:87
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

0a:c3:97:62:b2:d0:23:41:a6:9b:4b:29:dd:a9:f8:5a:1d:ef:7c:33
Signer

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 810KB - Virtual size: 809KB

.data
Size: 170KB - Virtual size: 226KB

.rsrc
Size: 6.8MB - Virtual size: 6.8MB

.reloc
Size: 280KB - Virtual size: 280KB