2024-10-21_e24883b5ffe0aa95187331675aac64bf_mafia_rhadamanthys

Sharing

Copy URL

Twitter E-mail

General

Target

2024-10-21_e24883b5ffe0aa95187331675aac64bf_mafia_rhadamanthys
Size

2.4MB
MD5

e24883b5ffe0aa95187331675aac64bf
SHA1

2fb5c2df26733ddfe8a7d7da7169dc1d67765062
SHA256

2ea9c996b35dd756d4aa0339f35f384ecdb34a171fd4e72327deec56ecae346d
SHA512

6326e6c29e733d0533e3b6b17bdcc62535e0839f2488063498ada43214ffaffba59f3f0196ef10282077009bb279e147e554bfe92daf3cb484c6d4d60dbfd9f1
SSDEEP

49152:voJ67eQD9rSllthuDZzjz4YVwPoIP6C1wGtaZXLVlOx9epr+P5Cbpf00DCc+FX7H:vngudzjz4YfIPz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-10-21_e24883b5ffe0aa95187331675aac64bf_mafia_rhadamanthys

Files

2024-10-21_e24883b5ffe0aa95187331675aac64bf_mafia_rhadamanthys
.exe windows:5 windows x86 arch:x86

92123d4a3b04ca0b3359b64c690e6528

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetProcessImageFileNameA
GetModuleFileNameExA
EnumProcessModules
EnumProcesses

comctl32

PropertySheetA
ord6
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ord17

winmm

PlaySoundA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

iphlpapi

GetAdaptersInfo

kernel32

SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetLocalTime
lstrcpyA
OpenProcess
MoveFileExA
GetFileSize
FileTimeToSystemTime
GetSystemDirectoryA
GetTimeZoneInformation
GetEnvironmentVariableA
GetShortPathNameA
CreateDirectoryA
RemoveDirectoryA
SetFileAttributesA
WritePrivateProfileStringA
GetModuleFileNameA
GetFileTime
FileTimeToLocalFileTime
GetExitCodeProcess
TerminateProcess
MoveFileA
GetProfileStringA
lstrcmpA
HeapCompact
lstrcatA
GetPrivateProfileStringA
CreateProcessA
GetModuleHandleA
ExpandEnvironmentStringsA
WriteProfileStringA
SearchPathA
lstrcmpiA
CompareStringA
IsProcessorFeaturePresent
RtlUnwind
LCMapStringW
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
EncodePointer
CreateFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetDateFormatA
GetTimeFormatA
CreateThread
GetCurrentThreadId
ExitThread
DecodePointer
ExitProcess
GetModuleHandleW
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
LoadLibraryA
GetProcAddress
GetCurrentProcess
FreeLibrary
_lread
FindNextFileA
FindClose
GlobalFree
CopyFileA
FindFirstFileA
GlobalUnlock
GlobalAlloc
WriteFile
GetWindowsDirectoryA
_lclose
GlobalLock
SetErrorMode
OpenFile
WinExec
lstrlenA
GlobalMemoryStatus
CreateMutexW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
SetStdHandle
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
QueryDosDeviceA

user32

GetWindowLongA
SystemParametersInfoA
GetMessageA
PostQuitMessage
SetWindowLongA
TranslateMessage
CreateWindowExA
DefWindowProcA
DispatchMessageA
RegisterClassA
DestroyWindow
ChildWindowFromPoint
GetClientRect
IsWindowEnabled
GetPropA
DrawTextA
GetWindowThreadProcessId
LoadBitmapA
FindWindowA
GetDlgItem
SendMessageA
LoadCursorA
wsprintfA
SetCursor
SetDlgItemTextA
GetDlgItemInt
SetTimer
GetWindowRect
MapDialogRect
SendDlgItemMessageA
KillTimer
GetParent
LoadIconA
RemovePropA
FindWindowExA
SetFocus
GetDC
SetPropA
TrackPopupMenuEx
MessageBoxA
BringWindowToTop
ReleaseDC
GetDesktopWindow
SetWindowPos
GetCursorPos
CreatePopupMenu
AppendMenuA
PostMessageA
SetMenuDefaultItem
DeferWindowPos
LoadImageA
UpdateWindow
EnableWindow
CallWindowProcA
GetDlgItemTextA
DestroyIcon
EndDeferWindowPos
GetSystemMetrics
InvalidateRect
GetClassNameA
SetForegroundWindow
LoadStringA
GetWindowTextA
ShowWindow
IsWindow
CharUpperBuffA
EndDialog
SetWindowTextA
DialogBoxParamA
MessageBoxExA
BeginDeferWindowPos

gdi32

SetBkMode
SelectObject
CreateFontA
GetStockObject
GetDeviceCaps
SetTextColor

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegOpenKeyA
CryptCreateHash
RegQueryValueA
CryptAcquireContextA
CryptReleaseContext
RegCloseKey
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
GetServiceKeyNameA
GetServiceDisplayNameA
QueryServiceStatusEx
CryptDestroyHash
CryptHashData
RegEnumKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteValueA
GetUserNameA
OpenServiceA
CloseServiceHandle
StartServiceA
QueryServiceStatus
OpenSCManagerA
ControlService
CryptGetHashParam

shell32

ExtractIconA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderPathA
SHGetFolderPathA

ole32

CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

VariantClear

Sections

.text
Size: 891KB - Virtual size: 892KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92123d4a3b04ca0b3359b64c690e6528

Headers

DLL Characteristics

File Characteristics

Imports

psapi

comctl32

winmm

version

wininet

iphlpapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 891KB - Virtual size: 892KB

.rdata Size: 90KB - Virtual size: 92KB

.data Size: 14KB - Virtual size: 72KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 891KB - Virtual size: 892KB

.rdata
Size: 90KB - Virtual size: 92KB

.data
Size: 14KB - Virtual size: 72KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB