maui | 2024-06-25_a18e8fc23d3ce325911674d7e9cac2cb_maui_revil

General

Target
2024-06-25_a18e8fc23d3ce325911674d7e9cac2cb_maui_revil
Size 763KB
Sample240625-ax75tstfql
SHA256 73fe8f1851654e60d42877231c633843269883b02d8ac62d9f62b8e220a49713
MD5 a18e8fc23d3ce325911674d7e9cac2cb
SHA1 2954212d87dc8f3220266315ac33885d7444cf27
SHA512 bc66b78536fbd4b9d90cd49cfcb0fc145f81eca9e3d00fb828cc94a2c4f268576c4057a1a2ee96b5bafc468f9d20db3927fa6e41962aa44a148803ba2406986f
SSDEEP 12288:Y+2NRE6xDWPOO3Kt7RJatTrAtfpYqCXd9rxhQjx:YhRxWPOO3Kt7FfpYhXjHQjx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

maui

Malware Config

Signatures

Detect Maui ransomware 1 IoCs

resource	yara_rule
sample	family_maui

Maui family
maui

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-25_a18e8fc23d3ce325911674d7e9cac2cb_maui_revil

File Explorer

2024-06-25_a18e8fc23d3ce325911674d7e9cac2cb_maui_revil

.exe 763KB

2024-06-25_a18e8fc23d3ce325911674d7e9cac2cb_maui_revil

IMPHASH b7270585cf85c21db1df48e009263fb6
SHA256 73fe8f1851654e60d42877231c633843269883b02d8ac62d9f62b8e220a49713
MD5 a18e8fc23d3ce325911674d7e9cac2cb
SHA1 2954212d87dc8f3220266315ac33885d7444cf27
SHA512 bc66b78536fbd4b9d90cd49cfcb0fc145f81eca9e3d00fb828cc94a2c4f268576c4057a1a2ee96b5bafc468f9d20db3927fa6e41962aa44a148803ba2406986f
SSDEEP 12288:Y+2NRE6xDWPOO3Kt7RJatTrAtfpYqCXd9rxhQjx:YhRxWPOO3Kt7FfpYhXjHQjx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Maui ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeviceIoControl GetTempPathW GetCurrentThreadId CreateThread GetFileAttributesW InterlockedCompareExchange64 GetTempFileNameW CreateFileW SetFileTime GetSystemTimeAsFileTime GetTimeFormatA GetDateFormatA GetModuleHandleW GetProcAddress HeapAlloc GetLastError HeapFree DeleteFileW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA MoveFileW HeapReAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent WideCharToMultiByte GetTimeZoneInformation EnterCriticalSection LeaveCriticalSection RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection CreateFileA GetModuleFileNameA SetConsoleCtrlHandler FreeLibrary LoadLibraryA InitializeCriticalSectionAndSpinCount RaiseException SetFilePointer MultiByteToWideChar ReadFile GetConsoleCP GetConsoleMode VirtualFree VirtualAlloc HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId LCMapStringA LCMapStringW GetModuleHandleA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle FlushFileBuffers HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW GetExitCodeProcess CreateProcessW SetEndOfFile GetProcessHeap CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW CompareStringA GetCurrentDirectoryA GetFullPathNameA SetConsoleMode ReadConsoleInputA GetFileAttributesExW GetModuleFileNameW CloseHandle Sleep SetUnhandledExceptionFilter CreateMutexW ReleaseMutex WaitForSingleObject WriteFile ExitProcess GetVersion GlobalMemoryStatus FlushConsoleInputBuffer GetDriveTypeA

user32

MessageBoxA GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventA DeregisterEventSource RegisterEventSourceA

Sharing