Overview

overview

7

Static

static

3

2024-05-23...py.exe

windows7-x64

7

2024-05-23...py.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-23_ceb8d72171999b8d9901f10e0d90103d_mafia_nionspy

  • Size

    280KB

  • Sample

    240523-wyck7sbf2y

  • MD5

    ceb8d72171999b8d9901f10e0d90103d

  • SHA1

    cc46b41b3005a8dafa3cdcf871c27d9da582080c

  • SHA256

    3b4cf516bd4119cbbdcf878b99d6094963fe0cac3dd51a0cc9d61a0ac2c3a6b6

  • SHA512

    fbedff636a02fc4354fbafc0b1fef21fdfb2e6e5325b1536e2499c14bb0a64e506d009d2ca57e8919b1e793a2b5eaf51157c6130137b3471931f01ed92eea8b5

  • SSDEEP

    6144:RQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:RQMyfmNFHfnWfhLZVHmOog

Score
7/10

Malware Config

Targets

    • Target

      2024-05-23_ceb8d72171999b8d9901f10e0d90103d_mafia_nionspy

    • Size

      280KB

    • MD5

      ceb8d72171999b8d9901f10e0d90103d

    • SHA1

      cc46b41b3005a8dafa3cdcf871c27d9da582080c

    • SHA256

      3b4cf516bd4119cbbdcf878b99d6094963fe0cac3dd51a0cc9d61a0ac2c3a6b6

    • SHA512

      fbedff636a02fc4354fbafc0b1fef21fdfb2e6e5325b1536e2499c14bb0a64e506d009d2ca57e8919b1e793a2b5eaf51157c6130137b3471931f01ed92eea8b5

    • SSDEEP

      6144:RQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:RQMyfmNFHfnWfhLZVHmOog

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks