c2a1526dd574293fc7d7ea835b9a14a53fbc91df3b18bf7e652bb668677c7642 | Triage

Sharing

General

Target

NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe
Size

327KB
Sample

231023-wctbtsbg6w
MD5

4ba5800cf09bd91c4a18512fefdb60eb
SHA1

b820c7f57cc7e4728f91cc3a9c19c8163a44356f
SHA256

c2a1526dd574293fc7d7ea835b9a14a53fbc91df3b18bf7e652bb668677c7642
SHA512

4a6557de8d0316ad1136b89d6c368e7dc3faf82e63bdece25bc5d838e139205a808e6c7cdb7759b41565a9f2235f7b6a611244fd0637436f7c3371e3b6cab32f
SSDEEP

6144:82+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:82TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Targets

- Target
  
  NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe
- Size
  
  327KB
- MD5
  
  4ba5800cf09bd91c4a18512fefdb60eb
- SHA1
  
  b820c7f57cc7e4728f91cc3a9c19c8163a44356f
- SHA256
  
  c2a1526dd574293fc7d7ea835b9a14a53fbc91df3b18bf7e652bb668677c7642
- SHA512
  
  4a6557de8d0316ad1136b89d6c368e7dc3faf82e63bdece25bc5d838e139205a808e6c7cdb7759b41565a9f2235f7b6a611244fd0637436f7c3371e3b6cab32f
- SSDEEP
  
  6144:82+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:82TFafJiHCWBWPMjVWrXK0
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2