face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Size 288KB
Sample230815-vj3y6scc38
SHA256 2dcbda5e96deca54be624823e93cb17ea158e2dcffb95f575b686a7875856192
MD5 face7bd424e80ca419b12ccd20b302ba
SHA1 44a12a3c7ee1fa8897cd6784e9cadadd94e767e0
SHA512 bba78325bf9e8021b03a5258614f5b9e33e8fde00540f19660db947df0a461c91c3d07f6fe625c86d059c78c4bf3161658172edb4ef0a1392fb19c3ddd1b9830
SSDEEP 6144:BQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:BQMyfmNFHfnWfhLZVHmOog
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe

File Explorer

face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe

.exe 288KB

face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe

IMPHASH 5c0e4007f69c1e2127fbd8b35d9e1818
SHA256 2dcbda5e96deca54be624823e93cb17ea158e2dcffb95f575b686a7875856192
MD5 face7bd424e80ca419b12ccd20b302ba
SHA1 44a12a3c7ee1fa8897cd6784e9cadadd94e767e0
SHA512 bba78325bf9e8021b03a5258614f5b9e33e8fde00540f19660db947df0a461c91c3d07f6fe625c86d059c78c4bf3161658172edb4ef0a1392fb19c3ddd1b9830
SSDEEP 6144:BQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:BQMyfmNFHfnWfhLZVHmOog
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144134

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess TerminateProcess Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock Process32First GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW LoadLibraryW IsValidCodePage EndUpdateResourceA LoadLibraryExA BeginUpdateResourceA LockResource UpdateResourceA FreeLibrary LoadResource FreeResource FindResourceA CloseHandle GetFileTime SetFileTime GlobalUnlock OpenFile GetOEMCP GetACP GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue GetProcessHeap TlsAlloc HeapSize IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetCPInfo MultiByteToWideChar LCMapStringW WideCharToMultiByte InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind

user32

SetWindowsHookExA TranslateMessage GetMessageA GetDesktopWindow DispatchMessageA GetDC GetWindowRect MessageBoxA UnhookWindowsHookEx GetKeyState GetWindowThreadProcessId GetForegroundWindow CallNextHookEx GetWindowTextA ReleaseDC GetKeyboardLayout OpenClipboard GetClipboardData CloseClipboard

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetGetConnectedState InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle

winmm

mciSendCommandA mciSendStringA

wsock32

send gethostbyname closesocket socket htons WSAStartup connect