2024-01-08_e6065348dbd128fe93c952a9bbe4729d_mafia_nionspy

Sharing

Copy URL Twitter E-mail

General

Target
2024-01-08_e6065348dbd128fe93c952a9bbe4729d_mafia_nionspy
Size 328KB
Sample240109-hll28agchj
SHA256 8aaa333ffc9a930e4d7be3ec617b6f600f50bcb2b758402fbe1beb5134f7e9c0
MD5 e6065348dbd128fe93c952a9bbe4729d
SHA1 7e5ac75382c56aace4f74600d209f9dd98e60df4
SHA512 18f94b0a8c68c778f6e747f2c81a3fba02f990226fe283fb55cf9d818d0c534a0067909eea37fecb0c9cb98f447a82be38767a8d33640d450662fcdc9ddc1311
SSDEEP 6144:I2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:I2TFafJiHCWBWPMjVWrXf1v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-08_e6065348dbd128fe93c952a9bbe4729d_mafia_nionspy

File Explorer

2024-01-08_e6065348dbd128fe93c952a9bbe4729d_mafia_nionspy

.exe 328KB

2024-01-08_e6065348dbd128fe93c952a9bbe4729d_mafia_nionspy

IMPHASH db7fd855f8d56ae5e931f5ee272b9c85
SHA256 8aaa333ffc9a930e4d7be3ec617b6f600f50bcb2b758402fbe1beb5134f7e9c0
MD5 e6065348dbd128fe93c952a9bbe4729d
SHA1 7e5ac75382c56aace4f74600d209f9dd98e60df4
SHA512 18f94b0a8c68c778f6e747f2c81a3fba02f990226fe283fb55cf9d818d0c534a0067909eea37fecb0c9cb98f447a82be38767a8d33640d450662fcdc9ddc1311
SSDEEP 6144:I2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:I2TFafJiHCWBWPMjVWrXf1v
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime GetDriveTypeA CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GlobalLock GlobalUnlock GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId TerminateProcess GetEnvironmentStringsW FreeEnvironmentStringsW CreatePipe GetFileAttributesA OpenProcess Process32First EndUpdateResourceA LoadLibraryExA BeginUpdateResourceA LockResource UpdateResourceA LoadResource FreeLibrary FreeResource FindResourceA CloseHandle GetFileTime SetFileTime GetLocaleInfoW LoadLibraryW IsValidCodePage GetOEMCP GetACP HeapSize GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate IsProcessorFeaturePresent GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError GetProcessHeap TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter OpenFile InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA DuplicateHandle GetCurrentProcess GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo

user32

SetWindowsHookExA TranslateMessage GetMessageA GetDesktopWindow DispatchMessageA GetDC GetWindowRect MessageBoxA UnhookWindowsHookEx GetKeyState GetForegroundWindow CallNextHookEx GetWindowTextA ReleaseDC OpenClipboard GetKeyboardLayout GetClipboardData GetWindowThreadProcessId CloseClipboard

gdi32

GetPixel BitBlt DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

HttpSendRequestA InternetConnectA InternetReadFile HttpOpenRequestA InternetGetConnectedState InternetCloseHandle InternetOpenA

winmm

mciSendStringA

wsock32

gethostbyname send closesocket socket recv htons WSAStartup connect

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2024-01-08_e6065348dbd128fe93c952a9bbe4729d_mafia_nionspy

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

generic