2024-07-09_e2e1796abfc6a903408b81bf18e3464e_mafia_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-09_e2e1796abfc6a903408b81bf18e3464e_mafia_poet-rat
Size

3.6MB
MD5

e2e1796abfc6a903408b81bf18e3464e
SHA1

7e6bf706468c9e7b7047efcde83ea1b088fc26cf
SHA256

57d10db50ad8f83e5d05ff35dd57ba0db9ff6e40626205799d463346e11ccaa9
SHA512

b0462326032aae612ef1c02c100af5f91505e60c8e4fb3751cc216b2a1383b355ead4253d1e4e8fc3572b35264cdd24be7a205f27658a131f26fcf2c561ccb8a
SSDEEP

49152:yAt5MCoV0irSz+OcHhq1YSJh05rrq9PVLKecmLcUUksjeTKTiklGpTJS:yA4gBpXorrqpVM/lG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-09_e2e1796abfc6a903408b81bf18e3464e_mafia_poet-rat

Files

2024-07-09_e2e1796abfc6a903408b81bf18e3464e_mafia_poet-rat
.exe windows:5 windows x86 arch:x86

98d92338514a6738907a55252f8a8978

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winusb

WinUsb_ReadPipe
WinUsb_WritePipe
WinUsb_SetPipePolicy
WinUsb_GetOverlappedResult
WinUsb_Free
WinUsb_Initialize
WinUsb_QueryInterfaceSettings
WinUsb_AbortPipe
WinUsb_QueryPipe

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

kernel32

OutputDebugStringA
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetTimeZoneInformation
ExitThread
GetCurrentDirectoryW
GetDateFormatW
GetTimeFormatW
HeapReAlloc
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
FindFirstFileExA
GetDriveTypeA
HeapAlloc
HeapFree
GetTickCount
EncodePointer
GetCommTimeouts
ResetEvent
CreateEventA
SetCommTimeouts
SetCommState
GetCommState
CreateFileA
lstrlenA
IsBadStringPtrA
IsBadReadPtr
RaiseException
GetCurrentThread
GetLogicalDriveStringsW
GetDriveTypeW
InterlockedExchange
CreateThread
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetTimeFormatA
GetDateFormatA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetOEMCP
SetHandleCount
PeekNamedPipe
SetEvent
WaitForMultipleObjects
WriteFile
ReadFile
ExpandEnvironmentStringsW
OutputDebugStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetACP
CopyFileW
GetFileType
GetTempFileNameW
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetFileInformationByHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetFileAttributesW
CreateFileW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
GetTempPathW
GetExitCodeThread
TlsAlloc
TlsFree
TlsGetValue
ResumeThread
TerminateThread
SetThreadPriority
ExitProcess
TlsSetValue
InterlockedDecrement
InterlockedIncrement
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
LocalFree
GetModuleFileNameW
TerminateProcess
WaitForSingleObject
GetProcAddress
GetCurrentProcess
CloseHandle
IsValidCodePage
GetCPInfo
Sleep
GetConsoleCP
GetCurrentProcessId
GetEnvironmentVariableW
DebugBreak
MultiByteToWideChar
WideCharToMultiByte
SetCurrentDirectoryW
GetProcessHeap
HeapSize
GlobalSize
GetCommandLineW
SetErrorMode
SetConsoleCursorPosition
FillConsoleOutputCharacterW
WriteConsoleW
WriteConsoleA
GetStdHandle
GetConsoleScreenBufferInfo
ReadConsoleOutputCharacterA
FreeConsole
GetVersionExW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
FreeLibrary
LoadLibraryW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
SetLastError
GetLastError
MulDiv
GetModuleHandleW
DeleteFileW
MoveFileW
GetFullPathNameW
GetEnvironmentStringsW
GetStringTypeW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetLocaleInfoA
EnumSystemLocalesA
SetEndOfFile
DecodePointer
CompareStringW

user32

ChildWindowFromPoint
GetWindowTextW
GetClassNameW
MessageBeep
UnionRect
EndPaint
BeginPaint
GetWindowDC
PostThreadMessageW
ValidateRect
GetMessageW
DestroyCursor
TranslateAcceleratorW
CreateAcceleratorTableW
DestroyAcceleratorTable
DrawIconEx
GetClassInfoW
CreateMenu
AppendMenuW
ModifyMenuW
RemoveMenu
InsertMenuItemW
InsertMenuW
CreatePopupMenu
GetSubMenu
DestroyMenu
SetMenu
DrawEdge
DrawStateW
SetRect
DrawFrameControl
SetMenuItemInfoW
CheckMenuRadioItem
CheckMenuItem
GetSysColorBrush
GetMenuState
PostMessageW
LoadCursorW
MsgWaitForMultipleObjects
GetDialogBaseUnits
EndDialog
EnumChildWindows
MessageBoxW
FindWindowExW
ValidateRgn
GetDesktopWindow
UnregisterClassW
GetSystemMenu
EnableMenuItem
DrawMenuBar
GetWindowPlacement
CreateDialogIndirectParamW
FlashWindow
IsIconic
IsZoomed
SetForegroundWindow
BringWindowToTop
keybd_event
GetWindowTextLengthW
HideCaret
LoadImageW
DestroyIcon
LoadBitmapW
LoadIconW
OffsetRect
CopyRect
CreateIconIndirect
GetIconInfo
DrawFocusRect
DrawTextW
AdjustWindowRectEx
CreateDialogParamW
InflateRect
PtInRect
UnregisterHotKey
RegisterHotKey
SetWindowsHookExW
GetMenuItemCount
GetMenuItemInfoW
SystemParametersInfoW
BeginDeferWindowPos
EndDeferWindowPos
MapWindowPoints
GetUpdateRgn
DeferWindowPos
MoveWindow
UpdateWindow
SetCursorPos
ReleaseCapture
SetFocus
DestroyWindow
ChangeDisplaySettingsW
EnumDisplaySettingsW
wsprintfW
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetClipboardFormatNameW
SetWindowRgn
ShowCursor
GetClientRect
GetSysColor
SetWindowTextW
IsWindow
CallWindowProcW
FillRect
InvalidateRect
SetCursor
IsDialogMessageW
TrackPopupMenu
GetCapture
CallNextHookEx
UnhookWindowsHookEx
ChildWindowFromPointEx
KillTimer
SetTimer
DdeFreeStringHandle
DdeUninitialize
DdeQueryStringW
DdeFreeDataHandle
DdeGetData
DdeCreateDataHandle
DdeGetLastError
DdeInitializeW
GetWindow
GetActiveWindow
GetMessageTime
IsWindowEnabled
IsWindowVisible
ClientToScreen
ScreenToClient
RedrawWindow
SetParent
WindowFromPoint
GetParent
ScrollWindow
EnableScrollBar
SetScrollInfo
GetScrollInfo
SetCapture
SetWindowPos
ShowWindow
GetFocus
EnableWindow
SetWindowLongW
DdeDisconnect
DdeClientTransaction
DdeCreateStringHandleW
DdeNameService
DdeConnect
GetWindowLongW
GetKeyState
GetAsyncKeyState
VkKeyScanW
MapVirtualKeyW
GetDC
ReleaseDC
PeekMessageW
DispatchMessageW
TranslateMessage
GetCursorPos
GetMessagePos
SendMessageW
GetSystemMetrics
GetWindowRect
PostQuitMessage
CreateWindowExW
RegisterClassW
DefWindowProcW
DdePostAdvise
MessageBoxA
GetDlgItem
PostMessageA
GetDoubleClickTime

gdi32

GetCharABCWidthsW
GetTextExtentExPointW
Arc
Pie
Polygon
SetPolyFillMode
PolyPolygon
Rectangle
RoundRect
Ellipse
MaskBlt
ExtTextOutW
StretchDIBits
StretchBlt
GetRgnBox
EqualRgn
PtInRegion
RectInRegion
CombineRgn
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
CreateHatchBrush
SaveDC
RestoreDC
CreateRectRgnIndirect
LineTo
ExtFloodFill
SetTextAlign
CreateICW
ExtCreatePen
CreateDIBSection
GetDIBits
CreateDIBitmap
GetDIBColorTable
EnumFontFamiliesExW
SetAbortProc
StartDocW
EndDoc
StartPage
EndPage
CreateDCW
GetSystemPaletteEntries
GetEnhMetaFileW
DeleteEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
PlayEnhMetaFile
CloseEnhMetaFile
ExtSelectClipRgn
SetStretchBltMode
GetBkColor
SelectClipRgn
SetMapMode
SetViewportExtEx
SetWindowOrgEx
SetWindowExtEx
PolyBezier
SetPixel
GetPixel
SetViewportOrgEx
SetROP2
Polyline
GetClipBox
GetStockObject
CreatePatternBrush
GetRegionData
ExtCreateRegion
OffsetRgn
CreatePen
CreateBitmap
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateCompatibleDC
GetObjectW
CreateSolidBrush
GetOutlineTextMetricsW
DeleteObject
CreateFontIndirectW
GetDeviceCaps
ExcludeClipRect
SetBrushOrgEx
CreateRectRgn
GdiFlush
GetTextExtentPoint32W
SelectPalette
RealizePalette
SelectObject
GetTextMetricsW
SetTextColor
MoveToEx
SetBkMode
SetBkColor

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

PrintDlgW
ChooseColorW
ChooseFontW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
PageSetupDlgW

advapi32

GetUserNameW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegDeleteKeyW

shell32

SHGetSpecialFolderLocation
SHGetFileInfoW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ExtractIconExW
ExtractIconW
DragQueryFileW
DragQueryPoint
DragFinish
DragAcceptFiles

ole32

CoTaskMemAlloc
CoCreateInstance
RevokeDragDrop
OleUninitialize
OleInitialize
CoTaskMemFree
RegisterDragDrop
CoLockObjectExternal
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
ReleaseStgMedium
OleGetClipboard

comctl32

ord16
ord17
ImageList_Destroy
ImageList_Draw
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Create
ImageList_Add
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragLeave
ImageList_GetImageCount
ImageList_EndDrag

rpcrt4

UuidToStringW
RpcStringFreeW

Exports

Exports

pcre_callout
pcre_compile
pcre_compile2
pcre_copy_named_substring
pcre_copy_substring
pcre_exec
pcre_free
pcre_free_substring
pcre_free_substring_list
pcre_fullinfo
pcre_get_named_substring
pcre_get_stringnumber
pcre_get_stringtable_entries
pcre_get_substring
pcre_get_substring_list
pcre_malloc
pcre_stack_free
pcre_stack_malloc

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 783KB - Virtual size: 782KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 10.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98d92338514a6738907a55252f8a8978

Headers

DLL Characteristics

File Characteristics

Imports

winusb

setupapi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

comctl32

rpcrt4

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 783KB - Virtual size: 782KB

.data Size: 42KB - Virtual size: 10.3MB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 260KB - Virtual size: 260KB

.reloc Size: 323KB - Virtual size: 323KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 783KB - Virtual size: 782KB

.data
Size: 42KB - Virtual size: 10.3MB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 260KB - Virtual size: 260KB

.reloc
Size: 323KB - Virtual size: 323KB