Overview

overview

7

Static

static

3

2024-05-22...py.exe

windows7-x64

7

2024-05-22...py.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-22_1b6da1de4478aef3642caa2169fe9a89_mafia_nionspy

  • Size

    280KB

  • Sample

    240522-eat2xaba34

  • MD5

    1b6da1de4478aef3642caa2169fe9a89

  • SHA1

    97bac0043df18ac47181855d375fe79df57fa854

  • SHA256

    c7cb37f520a26d281b77bfc6a9877b5e145fa1f1a543b120bca7074b3d8e7e34

  • SHA512

    4f7a1a084ee591091fc6308836d13b32371dc7265f624d9653c56e14defb2e16f6def2f0acb380b3caa70b57262f4e32c40d27e634135f61ec0d2855569a8d76

  • SSDEEP

    6144:oTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:oTBPFV0RyWl3h2E+7pl

Score
7/10

Malware Config

Targets

    • Target

      2024-05-22_1b6da1de4478aef3642caa2169fe9a89_mafia_nionspy

    • Size

      280KB

    • MD5

      1b6da1de4478aef3642caa2169fe9a89

    • SHA1

      97bac0043df18ac47181855d375fe79df57fa854

    • SHA256

      c7cb37f520a26d281b77bfc6a9877b5e145fa1f1a543b120bca7074b3d8e7e34

    • SHA512

      4f7a1a084ee591091fc6308836d13b32371dc7265f624d9653c56e14defb2e16f6def2f0acb380b3caa70b57262f4e32c40d27e634135f61ec0d2855569a8d76

    • SSDEEP

      6144:oTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:oTBPFV0RyWl3h2E+7pl

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks