Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_330c5016f891ee9f555896f17c33d6d8_karagany_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-09_330c5016f891ee9f555896f17c33d6d8_karagany_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_330c5016f891ee9f555896f17c33d6d8_karagany_mafia
-
Size
90KB
-
MD5
330c5016f891ee9f555896f17c33d6d8
-
SHA1
617b11d830aa257a1e9fc1bbc29bab60a1461680
-
SHA256
a819db53427c75bd3fbe84d00613d957375b562df08e445a4cf6fde1edee8074
-
SHA512
f3b6d1bac7853ffc7a355318090c0447936824b921a672d042ab00236f711ed02eebd85944096bb43a307e04227da850c8a98e45186f96d233a32cd02995de12
-
SSDEEP
1536:lNOdPpoMVh44sjGn1nrRjZ6g0kP8Hv3Rxzf1iIY:OdhoME29tYkkv3rBib
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-09_330c5016f891ee9f555896f17c33d6d8_karagany_mafia
Files
-
2024-10-09_330c5016f891ee9f555896f17c33d6d8_karagany_mafia.exe windows:5 windows x86 arch:x86
1c7788349804f94d639eb24ccedd3fcb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTokenInformation
userenv
CreateEnvironmentBlock
kernel32
EnumSystemLocalesA
GetLocaleInfoA
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
EncodePointer
GetLastError
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
HeapAlloc
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetUserDefaultLCID
IsValidLocale
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ