mafiaware666 | Skull[.]zip | Triage

Sharing

General

Target

Skull.zip
Size

1.3MB
MD5

becfdfe3b64ba3a759aeb2c40280d7fc
SHA1

b15d49d221a8b63ae2ed207c0d8b44a1be2be686
SHA256

a9573f790d011f3bc8765eb14d0edf0ab1951eb651ae27546b60030feaee4071
SHA512

9cb48339d9adcda0720030c5186b645d5891613dad9558fcd8f380c4efa209e515b8ebb7494757a88286233464023ae7a592bca43c593f89bb0d7b13eaad860c
SSDEEP

24576:lw2DLlFLPzsT/IBDeEFsGJiTZwDDd3W3JcZ4zH:lw2D3PzsLWPJiTZV5cmzH

Score

10^/10

mafiaware666

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
static1/unpack001/Skull.exe	family_mafiaware666

Mafiaware666 family
mafiaware666

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Skull.exe

Files

Skull.zip
.zip

Password: 3030
Skull.exe
.exe windows:4 windows x86 arch:x86

Password: 3030

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\safe folder\EncrypterPOC-main\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ