General

  • Target

    2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia

  • Size

    653KB

  • Sample

    240128-fb3acabef4

  • MD5

    16e87bc6047490d5a2afb024aaf3c131

  • SHA1

    afb0d6930510fb9f08ea67735c53daa992c21cb1

  • SHA256

    d8538700423ba52ed9a6e1c38410c397a4a98871e8de2ab3b054c780dd68f763

  • SHA512

    d42b61ce1b198b000e8d1ebebea31885903af0dfc6ee51274c8a294dea0726939d646e02a0d1f12c94197e52f82dc4b9d5009d8e03c488c2433f673fb256d5f9

  • SSDEEP

    12288:Yij0isJD+m3srW+5tEZG1QRw7rZ0n9sLXxGkgXYhfu0tF:lIiG+m8rWwHfR0yXkkxVtF

Malware Config

Targets

    • Target

      2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia

    • Size

      653KB

    • MD5

      16e87bc6047490d5a2afb024aaf3c131

    • SHA1

      afb0d6930510fb9f08ea67735c53daa992c21cb1

    • SHA256

      d8538700423ba52ed9a6e1c38410c397a4a98871e8de2ab3b054c780dd68f763

    • SHA512

      d42b61ce1b198b000e8d1ebebea31885903af0dfc6ee51274c8a294dea0726939d646e02a0d1f12c94197e52f82dc4b9d5009d8e03c488c2433f673fb256d5f9

    • SSDEEP

      12288:Yij0isJD+m3srW+5tEZG1QRw7rZ0n9sLXxGkgXYhfu0tF:lIiG+m8rWwHfR0yXkkxVtF

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks