251121-mgql3aeq4y_pw_infected.zip
- SHA256 c2e4070c49e787da4bd7c76b7ed5ba8123401c27c99bbf27598a773265937612
Password
infected
Behavioral task
behavioral1
Sample
3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
Resource
win11-20250502-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 251121-mgql3aeq4y_pw_infected.zip
- Size 348KB
- Sample251124-xvkcbavjan
- SHA256 c2e4070c49e787da4bd7c76b7ed5ba8123401c27c99bbf27598a773265937612
- MD5 91632c43f4f8a6dab574f16449ade0c3
- SHA1 55b170cdd30d27e254d0ba7b7951062f8e61177a
- SHA512 d6d8783933804a0bd1384a6d96e74db918166403b23b97ad73a97a466c6c0a7bb8c6c0d10c50c7cfd30359277dcf8ded04fbbb353e0c3306aaed6e2e3ec65ebd
- SSDEEP 6144:3lBpM8kHdaBGid+MkL9uFvpOq6GvisNYTUvcbdCdDg6ps0cd+:rpyHdaByLgPOqVNSdsds6ps0co
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects MariRAT payload 1 IoCs
resource yara_rule static1/unpack001/3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.bin family_markirat - Markirat family
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.bin
File Explorer
-
251121-mgql3aeq4y_pw_infected.zip.zip 348KB
-
3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.bin.exe 656KB
3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.bin
- IMPHASH 331199a7a4d1d1bcb45ccc7ce3ba023b
- SHA256 3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630
- MD5 21e82cf77235daceff772b250ddb3437
- SHA1 ef9205d9dba27091460d3a39c530d0501630538f
- SHA512 36af6898749356d84b72af05d257149688504e7e5191381c9983886d7c6107966f3f5031c4252a001a88316e88d54436d64539be86123f27b4572df74a765ec5
- SSDEEP 12288:TYcts2ucwpeaqvLaa0u32WcO7aMhP224lRL/DclzZjbhLiaeOulrpvAAtSNPzPm8:TYctBrvlzcA3g/DclzZjlTeOulrpvAo8
- MD5 SHA1 SHA512 SSDEEP
-
Detects MariRAT payload
-
Codesign digest Mismatch
File was altered after it was signed.
Password
infected
PE Signature issue
Digest
34:2b:13:4d:86:37:37:d6:e0:5d:f4:b1:24:d6:df:d7:1c:70:32:db:a3:9d:71:59:58:2d:af:f3:c1:6e:d5:9f
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 18, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:32BD-E3D5-3B1D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ad:fc:df:4d:58:e3:5d:32:e9:00:01:00:00:01:ad
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
198994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\mklgs\mfcmklg\Release\mfcmklg.pdb
kernel32
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
SystemTimeToTzSpecificLocalTime
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
MoveFileExW
EnumSystemLocalesW
IsValidLocale
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetStdHandle
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetCPInfo
LCMapStringW
GetTickCount
GetExitCodeThread
SwitchToThread
Sleep
QueryPerformanceFrequency
TryEnterCriticalSection
GetStringTypeW
OutputDebugStringW
GetCurrentProcess
DuplicateHandle
WriteFile
SetEndOfFile
ReadFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
VirtualProtect
CreateFileW
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
FormatMessageW
LocalFree
CompareStringW
GlobalFindAtomW
LoadLibraryA
GetSystemDirectoryW
EncodePointer
MulDiv
GetCurrentProcessId
GlobalAddAtomW
SetThreadPriority
CreateEventW
SetEvent
GlobalFree
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
SetLastError
GetACP
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
GlobalUnlock
GlobalLock
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
CreateDirectoryA
CreateMutexW
GetComputerNameW
CreateProcessW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetEnvironmentVariableA
OutputDebugStringA
GetEnvironmentVariableW
MultiByteToWideChar
FindClose
FindNextFileW
FindFirstFileW
WideCharToMultiByte
GetThreadPriority
GetLastError
user32
WinHelpW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
RemovePropW
GetPropW
SetPropW
GetScrollPos
RedrawWindow
SetForegroundWindow
UpdateWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
MonitorFromWindow
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetDC
GetSystemMetrics
OpenClipboard
GetClipboardData
SetWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetSysColor
ScreenToClient
ClientToScreen
SetWindowTextW
GetMonitorInfoW
EndPaint
BeginPaint
ShowWindow
GetCapture
CloseClipboard
GetKeyboardLayout
GetForegroundWindow
GetWindowTextW
GetWindowThreadProcessId
GetAsyncKeyState
wsprintfW
LoadIconW
SendMessageW
IsIconic
GetClientRect
DrawIcon
EnableWindow
UnregisterClassW
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetParent
PostMessageW
PostQuitMessage
IsWindow
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
SetActiveWindow
GetWindowLongW
GetDesktopWindow
IsDialogMessageW
LoadCursorW
RealChildWindowFromPoint
SetTimer
KillTimer
InvalidateRect
GetSysColorBrush
CharUpperW
DestroyMenu
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
SetCursor
MessageBoxW
GetLastActivePopup
UnhookWindowsHookEx
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
ReleaseDC
gdi32
GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SetBkColor
SetMapMode
SetTextColor
GetDeviceCaps
GetObjectW
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetClipBox
Escape
CreateBitmap
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegEnumKeyW
RegCloseKey
RegEnumValueW
RegQueryValueW
GetUserNameW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
shell32
ShellExecuteW
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
ole32
CoTaskMemFree
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
oleaut32
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysFreeString
gdiplus
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdiplusStartup
GdipDisposeImage
GdipCreateBitmapFromFile
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipGetImageWidth
GdipGetImageHeight
GdiplusShutdown
winhttp
WinHttpOpen
WinHttpReceiveResponse
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpQueryHeaders
oleacc
CreateStdAccessibleObject
LresultFromObject
Name
.text
Size
462KB
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=26715,
count=33, id=260, version=26715,
count=198, id=261, version=26715,
count=1, id=262, version=26715,
count=29, id=257, version=26715,
count=623, id=1, productName=Unmarked objects,
count=19, id=260, version=28920,
count=26, id=259, version=28920,
count=233, id=261, version=28920,
count=8, id=265, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,