2024-06-08_6deac5dc7b4b990bcd9d61018a258467_ironstealer_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-08_6deac5dc7b4b990bcd9d61018a258467_ironstealer_mafia
Size

4.8MB
MD5

6deac5dc7b4b990bcd9d61018a258467
SHA1

7b5ee6d2ea2f648170ebe2c94ad7fb5bbd08fcd7
SHA256

a35356d907cba4accfe537a4cc514e820675ddc3bc5db6bd4326b69977a1103b
SHA512

39e54bd27186227161789f9df17ab177e5bfdeed19483512f9932bbc0c93081f7b306c40e74f36c0bfbd9a0c4473689c4d104232879d488fd7d0d667619f03ef
SSDEEP

98304:nEkm56V6bhhC8MndFvJah/9inCuBInw3qvYtNRlYAtlgS:nEkJ6bhhGZJ00nCueHwt9YA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-08_6deac5dc7b4b990bcd9d61018a258467_ironstealer_mafia

Files

2024-06-08_6deac5dc7b4b990bcd9d61018a258467_ironstealer_mafia
.exe windows:5 windows x86 arch:x86

9b3589f7b0ca5d4185176ef301586b10

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\dev\fonline-aop-release\client\ClientDX.pdb

Imports

kernel32

QueryPerformanceFrequency
QueryPerformanceCounter
GetLocalTime
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
MoveFileW
DeleteFileW
GetFileSize
GetFileTime
SetFilePointer
WriteFile
ReadFile
CreateFileW
CreateFileA
ReadProcessMemory
GetVersionExA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
GetThreadContext
ResumeThread
GetLastError
SetUnhandledExceptionFilter
VirtualProtect
GetCurrentProcess
FlushInstructionCache
VirtualFree
VirtualAlloc
GetCurrentProcessId
OpenProcess
GetProcAddress
RtlCaptureStackBackTrace
FreeLibrary
GetACP
WideCharToMultiByte
Sleep
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
MapViewOfFile
UnmapViewOfFile
CloseHandle
CreateFileMappingA
CreateMutexA
GetModuleHandleA
GetModuleFileNameA
SetCurrentDirectoryA
Beep
ExitProcess
GetSystemInfo
IsProcessorFeaturePresent
GetVolumeInformationA
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
GetExitCodeProcess
GetProcessHeap
SetEndOfFile
CompareStringW
WriteConsoleW
SetStdHandle
FlushFileBuffers
SetEnvironmentVariableA
SetEnvironmentVariableW
GetFullPathNameA
SetCurrentDirectoryW
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
LoadLibraryW
CreateProcessA
OutputDebugStringA
LoadLibraryA
MultiByteToWideChar
GetFullPathNameW
SetConsoleCtrlHandler
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FatalAppExitA
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetModuleFileNameW
GetStdHandle
HeapSize
HeapDestroy
HeapCreate
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
InterlockedCompareExchange
GetLocaleInfoA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameA
GetFileAttributesA
DebugBreak
GetSystemTime
lstrlenA
SetEvent
CreateEventA
InterlockedExchangeAdd
GetProcessAffinityMask
TlsAlloc
SetLastError
TlsGetValue
GetThreadPriority
DuplicateHandle
GetCurrentThread
SetThreadPriority
ReleaseSemaphore
TlsSetValue
CreateSemaphoreA
TlsFree
ResetEvent
SetThreadContext
WaitForMultipleObjects
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetFileAttributesW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapReAlloc
GetModuleHandleW
SetFileAttributesW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
RemoveDirectoryW
GetTimeZoneInformation
ExitThread
CreateThread
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetOEMCP
IsValidCodePage

user32

SetTimer
FlashWindow
SetCursorPos
GetWindowInfo
CreateWindowExA
KillTimer
ClientToScreen
MessageBoxA
GetDoubleClickTime
SetWindowPos
SetWindowLongA
GetWindowLongA
ShowCursor
LoadIconA
SetActiveWindow
MessageBeep
GetSysColor
SetForegroundWindow
WindowFromPoint
PostThreadMessageA
FillRect
ReleaseDC
GetDC
IsIconic
OpenIcon
BringWindowToTop
SetWindowTextW
SetCapture
DefWindowProcA
ShowWindow
DestroyWindow
GetParent
GetForegroundWindow
PostMessageA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardOwner
MapWindowPoints
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
PeekMessageA
SystemParametersInfoA
GetCursorPos
GetClipboardData
GetKeyboardLayout
GetSystemMetrics
AdjustWindowRectEx
GetWindowRect
CreateWindowExW
RegisterWindowMessageW
RegisterClassExW
LoadCursorA
DefWindowProcW
InvalidateRect
SetCursor
GetKeyState
GetAsyncKeyState
ValidateRgn
GetUpdateRgn
PostQuitMessage
ReleaseCapture
RegisterClassExA

advapi32

RegQueryValueExW
RegCloseKey
GetCurrentHwProfileA
RegOpenKeyW

fmod

?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?addDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAVDSP@2@@Z
?setBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?set3DSpread@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getMasterChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getUserData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?set3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
FMOD_System_Create
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?set3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?setParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z

ws2_32

WSASetLastError
inet_addr
WSAStartup
gethostbyname
htons
inet_ntoa
connect
WSAGetLastError
setsockopt
WSASocketA
closesocket
WSASend
__WSAFDIsSet
select
WSARecv

d3dx9_42

D3DXCreateTexture
D3DXCompileShaderFromResourceA
D3DXCreateEffectCompiler
D3DXCreateEffect
D3DXCreateTextureFromFileInMemory
D3DXCreateSkinInfo
D3DXLoadSurfaceFromFileInMemory
D3DXSaveSurfaceToFileInMemory
D3DXSaveSurfaceToFileA
D3DXMatrixOrthoLH
D3DXMatrixLookAtLH
D3DXCreateMesh
D3DXIntersect

d3d9

Direct3DCreate9

glu32

gluUnProject
gluProject

iphlpapi

GetAdaptersInfo

dbghelp

SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymCleanup
SymInitialize
SymSetOptions
SymFromAddr
UnDecorateSymbolName
SymGetLineFromAddr64
SymGetModuleInfo64
MiniDumpWriteDump

psapi

EnumProcessModules
GetModuleFileNameExA

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

comctl32

_TrackMouseEvent

gdi32

SetBkMode
SetTextAlign
SaveDC
RestoreDC
CreatePolygonRgn
LPtoDP
LineTo
MoveToEx
SetPixel
Polygon
SelectObject
SelectClipRgn
RectInRegion
DPtoLP
GetRgnBox
EqualRgn
GetDeviceCaps
CreateDCA
CreatePen
GetStockObject
CreateSolidBrush
CreateRectRgn
SelectPalette
CreatePalette
GetTextMetricsA
CreateFontA
GetTextExtentPoint32W
GetGlyphOutlineW
GetCharacterPlacementW
TextOutW
SetTextColor
DeleteDC
GetDIBits
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
ExtCreatePen
UpdateColors
CombineRgn
CreateBitmap
Polyline
PolyPolygon
Arc
Pie
SetDIBitsToDevice
StretchDIBits
DeleteObject
GdiFlush
RealizePalette

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance
OleUninitialize
OleInitialize
DoDragDrop
RegisterDragDrop

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 794KB - Virtual size: 794KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 41.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b3589f7b0ca5d4185176ef301586b10

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

fmod

ws2_32

d3dx9_42

d3d9

glu32

iphlpapi

dbghelp

psapi

winmm

comctl32

gdi32

shell32

ole32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 794KB - Virtual size: 794KB

.data Size: 67KB - Virtual size: 41.5MB

.tls Size: 62KB - Virtual size: 61KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 257KB - Virtual size: 256KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 794KB - Virtual size: 794KB

.data
Size: 67KB - Virtual size: 41.5MB

.tls
Size: 62KB - Virtual size: 61KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 257KB - Virtual size: 256KB