6d21526a4106ed479530a96e176ddaef8fc4d10dee47d72c39fced275b079f1e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-08_232e78b9f19ff7b44be0740a686b2530_mafia_nionspy_JC.exe
Size

280KB
Sample

231031-tvsrxaba4z
MD5

232e78b9f19ff7b44be0740a686b2530
SHA1

37d60ef76f6d7dc4c16a2f76ffcf959951e2963c
SHA256

6d21526a4106ed479530a96e176ddaef8fc4d10dee47d72c39fced275b079f1e
SHA512

544f3f9937465751ae59492ddbb633c1c5aa72e43565a1bca1b98e0242d67d2814357fff0aac2828d1ff5d20e9468281387d8d3ee4a391dd161cfda2c155ef66
SSDEEP

6144:PQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:PQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Targets

- Target
  
  NEAS.2023-09-08_232e78b9f19ff7b44be0740a686b2530_mafia_nionspy_JC.exe
- Size
  
  280KB
- MD5
  
  232e78b9f19ff7b44be0740a686b2530
- SHA1
  
  37d60ef76f6d7dc4c16a2f76ffcf959951e2963c
- SHA256
  
  6d21526a4106ed479530a96e176ddaef8fc4d10dee47d72c39fced275b079f1e
- SHA512
  
  544f3f9937465751ae59492ddbb633c1c5aa72e43565a1bca1b98e0242d67d2814357fff0aac2828d1ff5d20e9468281387d8d3ee4a391dd161cfda2c155ef66
- SSDEEP
  
  6144:PQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:PQMyfmNFHfnWfhLZVHmOog
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2