General

  • Target

    2024-01-29_aac5d6b9707b5e643fd44caa9f658b23_mafia

  • Size

    898KB

  • Sample

    240129-fge21aadf3

  • MD5

    aac5d6b9707b5e643fd44caa9f658b23

  • SHA1

    00dcbd2ed70e7e6070b2713572e73f323abee438

  • SHA256

    96a5eef0014d5a885750c4e4ab8902314288858ebc4face9a7620f43c6ea78d9

  • SHA512

    0078e78b1b29115024d1d8ddcc08f6c1d143fa4b934df269931ab0a73c33cc7292cd0b456105c16e028fb290664cfb405e92bb2a77b8d78506aa1ce1c0a8da62

  • SSDEEP

    12288:IsG1PmXpWkbsfiEtPPej6I3080FXnPWkDw4lNWEwwg1xGkg1aFSkYu8DU0OYhLuX:MPmXAkaiEtnej6H7nq1kkui6uKVO0e

Malware Config

Targets

    • Target

      2024-01-29_aac5d6b9707b5e643fd44caa9f658b23_mafia

    • Size

      898KB

    • MD5

      aac5d6b9707b5e643fd44caa9f658b23

    • SHA1

      00dcbd2ed70e7e6070b2713572e73f323abee438

    • SHA256

      96a5eef0014d5a885750c4e4ab8902314288858ebc4face9a7620f43c6ea78d9

    • SHA512

      0078e78b1b29115024d1d8ddcc08f6c1d143fa4b934df269931ab0a73c33cc7292cd0b456105c16e028fb290664cfb405e92bb2a77b8d78506aa1ce1c0a8da62

    • SSDEEP

      12288:IsG1PmXpWkbsfiEtPPej6I3080FXnPWkDw4lNWEwwg1xGkg1aFSkYu8DU0OYhLuX:MPmXAkaiEtnej6H7nq1kkui6uKVO0e

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks