�JV��݆��#7~�^���� m�]8VM���0�[s���b��Ճ8Шu�G�F���S�:�%��-�y}����2��ًs!^������$���_�a"����N���\�5�AT�u\+&M�(Z���+�Q?�;�����B/�4��<=�W0�q�Q(��E��O���5s���/<��w��\)��D�!j�#4åh3K��?�V�#�k#�ˎ���i<�3uDr%x�X���t��-S^�깳��kw�we��]�!G/��f�E�M8�&�n̘6Ҩ�R#�d���,��O�[�/ 0!q�J�zd�A�5�~��H�1���b��#�����ޘ(�+�@����K�T@����M�ٌ"R�:]J�xyyY<���a�4g�dthQ�� [{�̵`�i�?�`�3߶"�2�ي{��S�n���E�5�~`E��I~ os%Q�����Y��v�O�Wc��*%�N��\GM��Ԕ��9�:�7Yϒk��(�#Tҗ��f��\�X�ٿh�䂺���5�����w$�2HE�%�}s����vyM��P�ݟ�!N +�ͅ�肢����)��4m&��x��>�!��np�r��P!Ә�$�{\9#a�5D�)}߱ǝb7�H��M-+�r`А �T��Γ̣Z�B֯ ���C��k���x^F5��W���*Uod��-��Q[��4����ř˞�X@��n��2��?�D߿.���,z��"[����[��H~�)��!��=�� 1���[���.|e����4��-Q�������1=;T�,�!�41�Y�#������w��{�v�m}/k;|BU�2�F��\��OA�5�$�ΌIf�?�0�m2����)�_1d�9/I I�kج"'������� ���4^�cj�b>=�"6?:�pE�\�L[�>�7f}�����)?�����WmY𠮹J�3Kݍ�S�^�gK� GO�}��/)A�@�-���^��>��Q@ {��V�$�o(:�?�U�z�����X0��� 8jV ��ña8"�����|C��f�"{ǜr������3�R_b�$��<����rVE\1_=�e6/�ݟ87;`m��8��B�H����5,R\d���!}Ԛ��]b$>�'8���>M.�#>�1^�R�2�2߅�O*��q��_@[�a7 P���>�'�K�ማ��k��#���o��'h� e�p��%]���� 2�[�(ŝ��a%W�<HY���~�D2���{ W�IY�'����7u���\SR��O�26Y����T:�,���9%t�9Ȳ��ơ��=�B����sF7K~WC���需� �[`N�&$���"I�;"_��2~{�r���w�d�XfJ���Jh�ZSV��/�q쟻�������b�jl|��f��.�cLC��r��G �\� �<����\oW���|Ir�t�����o��j�j�1{������x�@!Ђ���h.dji��0�tbwڋT0���֢���EfR�S���%9�_J�1��Y�5�� Z%Ws�ڸ �,F�N�7���$�B�`��:�k�|I���^�|X�;��k�ʦ"�8U��dG��D�ʉ�=[�,�����q��b���̼H���)#���������p���x�GiwЧoE\�ż]h��ȗ5��qr�8�������~������{8�9S[!�C�o�7< ���<��~oz�^YS�w̯ݤ`�����Q���m�L��26/�ȩK�< ���ո�w0z�Vʓ���i�4?q˦*k9?V�0�z��+ai|��b����7 E�eM�2[�=wDt�3�lz���h��P�A����5:�ٜa���/����3k�f^�4q���3��HPU�.2�D�I��p���2�h����m��{Q��Q}p��,�wJ�����`K�hl���̱�����b�X��Ȱ��x���-E��qR��U�i��0i<������/8�D<���}� ��S�����]P�y*�ZdP���H����:c�^@|�i��/��?�)�l7��P)�����k�I������$��Z�)g-�2�A+��e� l�<e�_�(:��I6g�O���P����;�'��<��n����D�s���:VS��p��V� LEm% �YP���C�x�'��!��W��H�0T%=2�^�8S-�/��|�_7�?��CT��0H��tE��� ��s�q���%h�%c�EE̐��u�����廬����?�Yjf}} j#&��˕�0��q���L��kPW��b�h���ln�ݛ\)� �x�Y�ŵ�Y�s�ae��zw�j�t��3��.���l��2���i�g�B7�N ͨ:�_!4�����1y���Hm� ŦC�;�:#sN q���D��c��Ėw �V?�yWΗ;�O�B� b���mB����#�`0��y���:P�^@��12�6�����+�.�q������>`T����ٷ<݁Ƀ�s�������P:���3��� ��/�Ӌ�dr�*�;��K��M'�+ST������ YD ���rPrs*%qj�t�����Qv�g i���'Z��!�B�b�O�z�iqw�L�td�zO��S�x�s\�%�K����X�$���M�5-l�a��-5�5 �14Z@�M2���T=Pi2 ��PyKu�^sô�k�ITLVGh�9d�b6�r$=��Y��R�F�5�� LI�S�1�oG��6�MJ@�����x�mE�_ݐ+ �~��;�]�Z/��=��s���f��$���ӊfBX�[��M��_D�͗, �rϮɴ V��o'��"ȼ�i[1i��V�h��C}Bj-0*���[)�D%���8�9ޝ���k�)�; ��k?.�$�+��p�7��z��Ǖ�)��c�z=�h ��A��H�{c�x��S�u��x�M�h�"^ �f��`��c���F���,n[�h)���|��1���u�l-��8aD*�o8�'�}����"�콭��3�C@�1��@U��Am��hB6G�9��2M�q\��M:�>;��a���ěDb��H�'��k ��V-m>h!�8L0�*��Ȯ���egB��d\y���qm���Z*C-�HRxJx�(�Bgн?�V>��- �gr���h{ܺ�S ���V����6\���M{����<J�)y��(�d�խ�˭~�}nPI}�8v�}������`�j�kɥ�dfwD1hZ�K�R��7,��G�0@�*R�fU��V�,?"p�!%ذ���OVreh^D֩��ѿ��z]�_���\[���m$�Bhss�8[���?a�o4���b���n���i���xDӮ�yA��\���Z~7v���dŪ�)�J��{���?Y1�d� _�W�����h�6�}��uZ��O����之ܙ��}w������na��qS�1�ew�v*��;�
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_82eaaac9ccf0a629f9f39b640816d9df_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-06_82eaaac9ccf0a629f9f39b640816d9df_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_82eaaac9ccf0a629f9f39b640816d9df_mafia
-
Size
13.8MB
-
MD5
82eaaac9ccf0a629f9f39b640816d9df
-
SHA1
bffffb33abc409b3f12f6fbd117ab592c065e5ac
-
SHA256
87884e5686e946183e7702fd426b6c812230f5ff86a772413ff4ed9fd8f215d1
-
SHA512
062f04745bb1ed103c68135f52e481157f8ed25468b0ce8db062e36e925ae39c38d3160656a8ca5b3f2ab4d889d85d8e0a3997ab7de0ddf4c3fa7bd17860ecab
-
SSDEEP
196608:niFZxVoqm792k05oDQWzlJlgNp+YeeQDkkEdwf7OmymSt1jwvSZWc7fmKW8Th3JU:i/od2kTkkEdwf7nSZfWa3boLSg4jU
Malware Config
Signatures
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-06_82eaaac9ccf0a629f9f39b640816d9df_mafia
Files
-
2024-06-06_82eaaac9ccf0a629f9f39b640816d9df_mafia.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 173KB - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE