2024-05-29_1abed07e674d6d05f3934b1db88e5050_mafia_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-29_1abed07e674d6d05f3934b1db88e5050_mafia_revil
Size

8.3MB
MD5

1abed07e674d6d05f3934b1db88e5050
SHA1

cdcfeb82815189586e3d10472069714cb1962697
SHA256

e5d9619832632a6c7a048404c4403eb4948ddee02db7c1bad051199099043967
SHA512

ceb301cb358b23358d92bef52014c9111e4119e66c54d351d5ca19e81dbecf3626a48e41c777e0462cd31f07e04113ee1264d9095f36702f0eca7314360b6801
SSDEEP

196608:OnGzMmsdEJyqkjskz+liAR+g8y/65+Y/qFUEuwMhU:OPmzJw+9c/qfuw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-29_1abed07e674d6d05f3934b1db88e5050_mafia_revil

Files

2024-05-29_1abed07e674d6d05f3934b1db88e5050_mafia_revil
.exe windows:5 windows x86 arch:x86

bb2d18c066b8280cf84166c6a7e12ba6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidFromStringA
UuidCreate
UuidToStringA
RpcStringFreeA

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsExA
SetupDiGetDeviceInterfaceDetailA

msimg32

TransparentBlt
AlphaBlend

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetCanonicalizeUrlA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

GetLocaleInfoW
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
PeekNamedPipe
GetCurrentDirectoryW
CreateFileW
GetDriveTypeW
CompareStringW
WriteConsoleW
SetEnvironmentVariableA
GetProcessHeap
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
SetStdHandle
HeapSize
HeapQueryInformation
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
FindFirstFileExA
GetDriveTypeA
SetConsoleCtrlHandler
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemInfo
CreateThread
ExitThread
HeapReAlloc
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
HeapFree
HeapAlloc
SetHandleCount
GetConsoleCP
LCMapStringW
IsValidCodePage
IsProcessorFeaturePresent
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
GetCurrentThread
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
CopyFileA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
FindResourceA
FindResourceExW
FindResourceExA
FreeLibrary
MultiByteToWideChar
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
GetLocalTime
CloseHandle
MapViewOfFile
CreateFileMappingA
lstrcpyA
ProcessIdToSessionId
GetCurrentProcessId
MoveFileA
DeleteFileA
GetFileSize
CreateFileA
GetSystemDirectoryA
GetTickCount
WinExec
lstrlenA
lstrcatA
GetWindowsDirectoryA
DeviceIoControl
OutputDebugStringA
GetUserDefaultLCID
SearchPathA
GetProfileIntA
InitializeCriticalSectionAndSpinCount
GetTempFileNameA
GetNumberFormatA
GetCurrentDirectoryA
SetErrorMode
GetOEMCP
GetCPInfo
GlobalFlags
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
WritePrivateProfileStringA
GetPrivateProfileIntA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
GetFileTime
GetFileSizeEx
SetFileAttributesA
GetFileAttributesExA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
lstrcmpiA
GetThreadLocale
RaiseException
SetThreadPriority
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
CreateEventA
ReleaseMutex
GlobalFree
GlobalSize
MulDiv
FlushConsoleInputBuffer
GlobalMemoryStatus
QueryPerformanceCounter
FindClose
FindFirstFileA
FindNextFileA
GetStdHandle
GetFileType
GetVersion
GetModuleHandleW
VirtualAlloc
SuspendThread
VirtualFree
GetThreadContext
SetThreadContext
FlushInstructionCache
ResumeThread
VirtualProtect
InterlockedCompareExchange
VirtualQuery
EnumResourceNamesA
EnumResourceLanguagesA
FormatMessageA
ActivateActCtx
DeactivateActCtx
SetLastError
SystemTimeToFileTime
CreateSemaphoreA
ReleaseSemaphore
SetEvent
LocalAlloc
CreateMutexA
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
GetFileAttributesA
lstrlenW
GetPrivateProfileStringA
CreatePipe
SetHandleInformation
GetExitCodeProcess
LocalFree
CreateDirectoryA
WriteFile
lstrcmpA
GetSystemTime
GetTimeZoneInformation
ExitProcess
TerminateProcess
GetCurrentThreadId
CompareFileTime
OpenFileMappingA
InterlockedExchange
GetTempPathA
ReadFile
RemoveDirectoryA
CreateProcessA
Sleep
GetACP
GetVersionExA
GetCurrentProcess
OpenProcess
DuplicateHandle
GetLogicalDriveStringsA
QueryDosDeviceA
CreateToolhelp32Snapshot
Process32First
Process32Next
WaitForSingleObject
TerminateThread
GetModuleHandleA
GetFileInformationByHandle
VerLanguageNameA
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource

user32

DrawFrameControl
DrawEdge
DestroyAcceleratorTable
SetParent
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
BringWindowToTop
TranslateAcceleratorA
LoadImageA
CopyImage
GetIconInfo
HideCaret
DrawFocusRect
InvertRect
GetMenuDefaultItem
CreatePopupMenu
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
IsZoomed
NotifyWinEvent
RedrawWindow
SetWindowRgn
GetSystemMenu
GetNextDlgGroupItem
PostThreadMessageA
DestroyIcon
LoadCursorW
EnumDisplayMonitors
CharNextA
ReleaseCapture
SetCapture
InvalidateRgn
OffsetRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
SetRectEmpty
UnregisterClassA
RealChildWindowFromPoint
GetSysColorBrush
DrawStateA
WaitMessage
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatA
ShowOwnedPopups
CharUpperA
MapVirtualKeyA
GetKeyNameTextA
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetMessageA
TranslateMessage
GetActiveWindow
WindowFromPoint
EndPaint
BeginPaint
GetWindowDC
GrayStringA
ToAsciiEx
DrawTextA
TabbedTextOutA
FillRect
IsWindowEnabled
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableA
IntersectRect
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetCursorPos
LockWindowUpdate
LoadImageW
FrameRect
CharUpperBuffA
IsCharLowerA
MapVirtualKeyExA
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
IsClipboardFormatAvailable
GetDoubleClickTime
SubtractRect
SetScrollInfo
CopyRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
GetMenuState
DestroyCursor
GetWindowRgn
DrawTextExA
GetClientRect
GetUpdateRect
InvalidateRect
ValidateRect
EnableWindow
DrawIconEx
SetTimer
GetMenuItemCount
GetMenuItemID
GetWindowRect
ClientToScreen
GetDesktopWindow
SetCursor
PtInRect
InflateRect
SendMessageA
ScreenToClient
GetDC
ReleaseDC
KillTimer
GetParent
GetMessagePos
GetSysColor
IsWindow
CopyIcon
LoadCursorA
SetWindowLongA
MessageBeep
PostMessageA
FindWindowA
LoadIconW
LoadBitmapW
DrawIcon
DeleteMenu
EnableMenuItem
SetMenuDefaultItem
GetSubMenu
InsertMenuA
ModifyMenuA
LoadMenuW
IsIconic
SetForegroundWindow
GetCursorPos
LoadBitmapA
GetSystemMetrics
PostQuitMessage
LoadIconA
GetWindowThreadProcessId
GetWindowTextA
IsWindowVisible
CloseWindow
SetClassLongA
GetClassLongA
GetWindowLongA
GetAsyncKeyState
WaitForInputIdle
ShowWindow
GetForegroundWindow
EnumWindows
SetLayeredWindowAttributes
SetWindowPos
TrackMouseEvent
CreateWindowExA
GetDlgItem
DestroyWindow
MessageBoxA
LoadStringA
UnregisterDeviceNotification
RegisterDeviceNotificationA
RegisterHotKey
AnimateWindow
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
UpdateWindow
GetWindow
GetMenuStringA
AppendMenuA
RemoveMenu
GetProcessWindowStation
GetUserObjectInformationW

gdi32

CreateRoundRectRgn
CreateDIBSection
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
OffsetRgn
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExA
ExtFloodFill
GetTextCharsetInfo
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
SetPixelV
GetTextFaceA
EnumFontFamiliesA
CreateDIBitmap
GetTextColor
GetBkColor
GetRgnBox
GetTextMetricsA
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateHatchBrush
CreatePen
GetObjectType
SelectPalette
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
GetStockObject
CreateFontIndirectA
GetObjectA
GetTextExtentPoint32A
GetBitmapBits
CreateCompatibleDC
CreateFontA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
GetDeviceCaps
CopyMetaFileA
CreateDCA
SetTextColor
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SetPaletteEntries

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumKeyA
ConvertSidToStringSidA
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptGetUserKey
CryptGetKeyParam
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptEnumProvidersA
CryptExportKey
CryptSignHashA
CryptSetHashParam
CryptAcquireContextW
CryptGetProvParam
RegCloseKey
RegSetValueExA
RegCreateKeyExA
CryptGenKey
CryptImportKey
CryptSetKeyParam
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
CopySid
GetLengthSid
IsValidSid
CryptSetProvParam
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
CryptEncrypt
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation

shell32

ShellExecuteA
SHGetSpecialFolderPathA
SHGetPathFromIDListA
SHBrowseForFolderA
SHAppBarMessage
DragQueryFileA
DragFinish
SHGetDesktopFolder
SHGetFileInfoA
SHGetFolderPathA
ShellExecuteExA
Shell_NotifyIconA
SHGetSpecialFolderLocation

comctl32

ImageList_GetIconSize

shlwapi

PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathFileExistsA
PathIsUNCA

ole32

DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoInitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid
CoInitializeEx
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
OleDuplicateData
ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

SysStringByteLen
SystemTimeToVariantTime
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
VariantCopy
DispCallFunc
LoadRegTypeLi
SysStringLen
LoadTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SysAllocStringByteLen
VarBstrCmp
SafeArrayDestroy
VariantTimeToSystemTime
VarBstrFromDate
OleCreateFontIndirect
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysFreeString

oledlg

ord8

ws2_32

WSASetLastError
shutdown
WSAAsyncSelect
bind
getsockname
ntohs
select
__WSAFDIsSet
accept
setsockopt
recv
send
socket
listen
WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
WSAGetLastError
closesocket
connect
inet_addr
htons

gdiplus

GdipDrawImageRectRect
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipSetInterpolationMode
GdipCreateBitmapFromStream
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipCreateFromHDC
GdipCloneImage
GdipDeleteGraphics
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipGetImageWidth
GdipGetImageHeight

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExA
GetProcessImageFileNameA

userenv

UnloadUserProfile

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore
CryptHashPublicKeyInfo
CertCloseStore
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertComparePublicKeyInfo
CertCompareCertificateName
CertFreeCertificateContext
CertCreateCertificateContext
CertGetCertificateContextProperty
CryptEncodeObject
CertFindExtension
CryptVerifyCertificateSignature
CertGetSubjectCertificateFromStore
CryptQueryObject
CertGetPublicKeyLength
CertGetIntendedKeyUsage
CertGetNameStringA
CertNameToStrA
CertCompareCertificate
CryptVerifyDetachedMessageSignature
CertSetCertificateContextProperty
CertAddEncodedCertificateToStore
CertAddCertificateContextToStore
CertOpenStore
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptProtectData
CryptUnprotectData
CryptVerifyMessageSignature
CryptDecodeObject

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 722KB - Virtual size: 722KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb2d18c066b8280cf84166c6a7e12ba6

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

setupapi

msimg32

wininet

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

gdiplus

wtsapi32

iphlpapi

psapi

userenv

wintrust

crypt32

oleacc

imm32

winmm

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 722KB - Virtual size: 722KB

.data Size: 57KB - Virtual size: 97KB

.rsrc Size: 4.4MB - Virtual size: 4.4MB

.reloc Size: 271KB - Virtual size: 270KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 722KB - Virtual size: 722KB

.data
Size: 57KB - Virtual size: 97KB

.rsrc
Size: 4.4MB - Virtual size: 4.4MB

.reloc
Size: 271KB - Virtual size: 270KB