2024-06-12_9b1b80f35c55d692eaf6c6c1cbe1e019_karagany_mafia

General

Target
2024-06-12_9b1b80f35c55d692eaf6c6c1cbe1e019_karagany_mafia
Size 529KB
Sample240612-e19kaa1bnb
SHA256 4d75f45865b21bb2ac2bc7c782687744900fec23103fcdd2c638a267f642d4d3
MD5 9b1b80f35c55d692eaf6c6c1cbe1e019
SHA1 66b81de89254dbceccd38f93abaa62b17f6bed17
SHA512 9e6204fc5b8e40a575f2e063bda8b25c7dfa70ec5909ee49da67dafde25684b09a98139a27fadc248031e75c71ee399025b6230bc22a16860f2258dbb0e5020e
SSDEEP 12288:P+xm/uD6u6URt+TcyAOT42Qbj9UnVIAUZaJ9Sl7AcLaZkjjOodQoG56JXAzQOe/G:eDMUz+TcyAOT42Qbj9UnVIAUZaJ9Sl7/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-12_9b1b80f35c55d692eaf6c6c1cbe1e019_karagany_mafia

File Explorer

2024-06-12_9b1b80f35c55d692eaf6c6c1cbe1e019_karagany_mafia

.exe 529KB

2024-06-12_9b1b80f35c55d692eaf6c6c1cbe1e019_karagany_mafia

IMPHASH bc2d7d86b0f93dc7068f59c46ea2d1b3
SHA256 4d75f45865b21bb2ac2bc7c782687744900fec23103fcdd2c638a267f642d4d3
MD5 9b1b80f35c55d692eaf6c6c1cbe1e019
SHA1 66b81de89254dbceccd38f93abaa62b17f6bed17
SHA512 9e6204fc5b8e40a575f2e063bda8b25c7dfa70ec5909ee49da67dafde25684b09a98139a27fadc248031e75c71ee399025b6230bc22a16860f2258dbb0e5020e
SSDEEP 12288:P+xm/uD6u6URt+TcyAOT42Qbj9UnVIAUZaJ9Sl7AcLaZkjjOodQoG56JXAzQOe/G:eDMUz+TcyAOT42Qbj9UnVIAUZaJ9Sl7/
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

22118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetLastError OpenEventW SetEvent CreateThread CloseHandle CreateEventW GetModuleFileNameW MultiByteToWideChar CreateProcessW DeleteFileW FindFirstFileW FindClose SetFileAttributesW SetLastError CreateDirectoryW CreateFileW SetFilePointer ReadFile WriteFile FlushFileBuffers SetEndOfFile GlobalAlloc GlobalFree GetTickCount Sleep InterlockedDecrement GetModuleFileNameA GetPrivateProfileStringA GetSystemTimeAsFileTime InterlockedExchange InterlockedExchangeAdd GetFileAttributesA InitializeCriticalSection WideCharToMultiByte LeaveCriticalSection EnterCriticalSection GetLocalTime DeleteCriticalSection WriteConsoleW SetStdHandle LoadLibraryW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapReAlloc GetStringTypeW GetConsoleMode GetConsoleCP GetLocaleInfoW GetCurrentProcessId QueryPerformanceCounter GetFileType InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer GetProcessHeap SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetCurrentThreadId TlsFree TlsSetValue HeapFree TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetStdHandle ExitProcess GetModuleHandleW GetProcAddress HeapCreate IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCPInfo LCMapStringW RtlUnwind RaiseException GetStartupInfoW HeapSetInformation GetCommandLineW HeapAlloc

user32

DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW TranslateMessage DefWindowProcW BeginPaint EndPaint PostQuitMessage TranslateAcceleratorW GetMessageW DestroyWindow LoadStringW wsprintfW PostMessageW LoadAcceleratorsW

ole32

CoInitialize CoUninitialize

ws2_32

htons setsockopt inet_addr socket recvfrom ntohs inet_ntoa WSAStartup WSACleanup sendto closesocket shutdown ioctlsocket connect select __WSAFDIsSet send recv htonl

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-12_9b1b80f35c55d692eaf6c6c1cbe1e019_karagany_mafia

kernel32

user32

ole32

ws2_32

generic