f8a5997d2828f5b951c2b6eefdd83ca6687d0e58e46962b1a244e7c8ad417c34 | Triage

Sharing

General

Target

2024-02-18_d96014cb614ade63ba5fb0a2f68644f5_mafia_nionspy
Size

288KB
Sample

240218-eh5tdade8z
MD5

d96014cb614ade63ba5fb0a2f68644f5
SHA1

c7a7b16ae259ee61331d0e30e8ca1baa704fc3c3
SHA256

f8a5997d2828f5b951c2b6eefdd83ca6687d0e58e46962b1a244e7c8ad417c34
SHA512

eb95181d37053de0d7ce6395ce8f56da081f84ebf53da1edfcf5b7b9f0158177ff3cf811d6364f97ddcc3e26072105646c4a4bae56102e952689fc240cfa6dbf
SSDEEP

6144:TQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:TQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Targets

- Target
  
  2024-02-18_d96014cb614ade63ba5fb0a2f68644f5_mafia_nionspy
- Size
  
  288KB
- MD5
  
  d96014cb614ade63ba5fb0a2f68644f5
- SHA1
  
  c7a7b16ae259ee61331d0e30e8ca1baa704fc3c3
- SHA256
  
  f8a5997d2828f5b951c2b6eefdd83ca6687d0e58e46962b1a244e7c8ad417c34
- SHA512
  
  eb95181d37053de0d7ce6395ce8f56da081f84ebf53da1edfcf5b7b9f0158177ff3cf811d6364f97ddcc3e26072105646c4a4bae56102e952689fc240cfa6dbf
- SSDEEP
  
  6144:TQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:TQMyfmNFHfnWfhLZVHmOog
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2