30bd0436ffb40e8e97f9739e568326d0880d511126003d7747dc355075891e40 | Triage

Sharing

General

Target

2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy
Size

280KB
Sample

240212-gelmfadg81
MD5

61e36b20ca3e84645e1cdab65b3c7eb2
SHA1

cb8431fbd6eed4917739e536fda71a24649a6a79
SHA256

30bd0436ffb40e8e97f9739e568326d0880d511126003d7747dc355075891e40
SHA512

1157a38b7182e62db869a7e2973731b0cc7f894ed7a0c28738c083c98cc41932ddf52e021b83f24f9b339874029c5892f72c961e448fe150790b5fc300a80ee2
SSDEEP

6144:5iQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:kQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Targets

- Target
  
  2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy
- Size
  
  280KB
- MD5
  
  61e36b20ca3e84645e1cdab65b3c7eb2
- SHA1
  
  cb8431fbd6eed4917739e536fda71a24649a6a79
- SHA256
  
  30bd0436ffb40e8e97f9739e568326d0880d511126003d7747dc355075891e40
- SHA512
  
  1157a38b7182e62db869a7e2973731b0cc7f894ed7a0c28738c083c98cc41932ddf52e021b83f24f9b339874029c5892f72c961e448fe150790b5fc300a80ee2
- SSDEEP
  
  6144:5iQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:kQMyfmNFHfnWfhLZVHmOog
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2