maui | be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7[.]exe

General

Target
be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7.exe
Size 789KB
Sample251226-tpqqcsspfj
SHA256 be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7
MD5 eb90f4972bb2ce1d7ac2af57c9f89cca
SHA1 ec02af010918b919165cbb2c43e08c309a4ad288
SHA512 c9cb95f04671c58b2c90e373d679577f59457b041363319aed15d735ee73be87acaf32c46aae4c3c8de1548637cbef921862e30c0995a8bc25a70664d7696a9a
SSDEEP 12288:2KWzz4UhTwleGJTQrDd7+lx9mouTpYqCWYrxhQjx:2XzPwle2TQrDdTpYhWIHQjx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

maui

Malware Config

Signatures

Detect Maui ransomware 1 IoCs

resource	yara_rule
sample	family_maui

Maui family
maui

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7.exe

File Explorer

be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7.exe

.exe 789KB

be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7.exe

IMPHASH b7270585cf85c21db1df48e009263fb6
SHA256 be341a334b568176964b2d41d6d91422eab6f53f7d51866b92c5c5b3debd85e7
MD5 eb90f4972bb2ce1d7ac2af57c9f89cca
SHA1 ec02af010918b919165cbb2c43e08c309a4ad288
SHA512 c9cb95f04671c58b2c90e373d679577f59457b041363319aed15d735ee73be87acaf32c46aae4c3c8de1548637cbef921862e30c0995a8bc25a70664d7696a9a
SSDEEP 12288:2KWzz4UhTwleGJTQrDd7+lx9mouTpYqCWYrxhQjx:2XzPwle2TQrDdTpYhWIHQjx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Maui ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeviceIoControl GetTempPathW GetCurrentThreadId CreateThread GetFileAttributesW InterlockedCompareExchange64 GetTempFileNameW CreateFileW SetFileTime GetSystemTimeAsFileTime GetTimeFormatA GetDateFormatA GetModuleHandleW GetProcAddress HeapAlloc GetLastError HeapFree DeleteFileW FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA MoveFileW HeapReAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent WideCharToMultiByte GetTimeZoneInformation EnterCriticalSection LeaveCriticalSection RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection CreateFileA GetModuleFileNameA SetConsoleCtrlHandler FreeLibrary LoadLibraryA InitializeCriticalSectionAndSpinCount RaiseException SetFilePointer MultiByteToWideChar ReadFile GetConsoleCP GetConsoleMode VirtualFree VirtualAlloc HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId LCMapStringA LCMapStringW GetModuleHandleA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle FlushFileBuffers HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW GetExitCodeProcess CreateProcessW SetEndOfFile GetProcessHeap CompareStringW SetEnvironmentVariableA SetEnvironmentVariableW CompareStringA GetCurrentDirectoryA GetFullPathNameA SetConsoleMode ReadConsoleInputA GetFileAttributesExW GetModuleFileNameW CloseHandle Sleep SetUnhandledExceptionFilter CreateMutexW ReleaseMutex WaitForSingleObject WriteFile ExitProcess GetVersion GlobalMemoryStatus FlushConsoleInputBuffer GetDriveTypeA

user32

MessageBoxA GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventA DeregisterEventSource RegisterEventSourceA

Sharing