1e553d758f08fe7463384de0e8125d01f0e66f5235f187bba5316ddbea93f8ea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-09_3ccd4ece6ad546ec76e70016c194876c_mafia_nionspy_JC.exe
Size

327KB
Sample

231022-mw6xlafg21
MD5

3ccd4ece6ad546ec76e70016c194876c
SHA1

e91d4a01eb3d034c2d6744db8f1727190903ce4c
SHA256

1e553d758f08fe7463384de0e8125d01f0e66f5235f187bba5316ddbea93f8ea
SHA512

03599916a3b4a745f694dc896952ea661d9f833c570b25bdea0c9dac9a1b5537c4a9a5e5b0df2eb8d0739c7c1ceb0d3e230235380952bedc3d86dd24bdb3e23e
SSDEEP

6144:u2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:u2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Targets

- Target
  
  NEAS.2023-09-09_3ccd4ece6ad546ec76e70016c194876c_mafia_nionspy_JC.exe
- Size
  
  327KB
- MD5
  
  3ccd4ece6ad546ec76e70016c194876c
- SHA1
  
  e91d4a01eb3d034c2d6744db8f1727190903ce4c
- SHA256
  
  1e553d758f08fe7463384de0e8125d01f0e66f5235f187bba5316ddbea93f8ea
- SHA512
  
  03599916a3b4a745f694dc896952ea661d9f833c570b25bdea0c9dac9a1b5537c4a9a5e5b0df2eb8d0739c7c1ceb0d3e230235380952bedc3d86dd24bdb3e23e
- SSDEEP
  
  6144:u2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:u2TFafJiHCWBWPMjVWrXK0
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2