General

  • Target

    2024-01-28_1db92e52abffb5c7209609fa1defb5e8_mafia

  • Size

    653KB

  • Sample

    240128-fb5qgabef5

  • MD5

    1db92e52abffb5c7209609fa1defb5e8

  • SHA1

    0d314e1ef247108c84254eb76db24ceeba577792

  • SHA256

    32fed7059b6e6f19778a91dc7cc72e41f1cefc03f65b0e5bd686caa9a550d3c0

  • SHA512

    38f91004d45de3b197534767bc82faeafe6f9bfd27dfe2508296525ec115b57c13dfdf81969a6852764efc14bf99db243a29b75247ba7b158b66277da9cd42e0

  • SSDEEP

    12288:cij0isJD+m3srW+5tEZG1QRw7rZ0n9sLXxGkgXYhfu0tF:5IiG+m8rWwHfR0yXkkxVtF

Malware Config

Targets

    • Target

      2024-01-28_1db92e52abffb5c7209609fa1defb5e8_mafia

    • Size

      653KB

    • MD5

      1db92e52abffb5c7209609fa1defb5e8

    • SHA1

      0d314e1ef247108c84254eb76db24ceeba577792

    • SHA256

      32fed7059b6e6f19778a91dc7cc72e41f1cefc03f65b0e5bd686caa9a550d3c0

    • SHA512

      38f91004d45de3b197534767bc82faeafe6f9bfd27dfe2508296525ec115b57c13dfdf81969a6852764efc14bf99db243a29b75247ba7b158b66277da9cd42e0

    • SSDEEP

      12288:cij0isJD+m3srW+5tEZG1QRw7rZ0n9sLXxGkgXYhfu0tF:5IiG+m8rWwHfR0yXkkxVtF

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks