2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy
Size 344KB
Sample240528-kpdlcsda2t
SHA256 e6ce4804c8558d7e16b753b77c6b70c813c8aa0e09edd94b8c1daa48405a82b2
MD5 49c1103d13de84ed54806eb41f82b0fb
SHA1 06773fea288001c1612669989560c65e298f4bd7
SHA512 e5fe03bb2c75c24e2e633b0febef95a1a199d60d81639ebe9f5dcdb76d7ce61eaf3cf02bdb237f1b9976357ae9b81f081f3e15384141253f1c4ba91e5f2b9464
SSDEEP 6144:pTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:pTBPFV0RyWl3h2E+7pYm0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy

File Explorer

2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy

.exe 344KB

2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy

IMPHASH 7ed4bec1fe79dc04ec708edabf2bd02e
SHA256 e6ce4804c8558d7e16b753b77c6b70c813c8aa0e09edd94b8c1daa48405a82b2
MD5 49c1103d13de84ed54806eb41f82b0fb
SHA1 06773fea288001c1612669989560c65e298f4bd7
SHA512 e5fe03bb2c75c24e2e633b0febef95a1a199d60d81639ebe9f5dcdb76d7ce61eaf3cf02bdb237f1b9976357ae9b81f081f3e15384141253f1c4ba91e5f2b9464
SSDEEP 6144:pTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:pTBPFV0RyWl3h2E+7pYm0
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime GetDriveTypeA CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GlobalLock GlobalUnlock GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId QueryPerformanceCounter TerminateProcess FreeEnvironmentStringsW GetLocaleInfoW LoadLibraryW IsValidCodePage OpenProcess Process32First EndUpdateResourceA LoadLibraryExA BeginUpdateResourceA LockResource UpdateResourceA LoadResource FreeLibrary FreeResource FindResourceA CloseHandle GetFileTime SetFileTime GetOEMCP GetACP HeapSize GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate IsProcessorFeaturePresent GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError TlsFree TlsSetValue GetProcessHeap TlsGetValue TlsAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetCPInfo MultiByteToWideChar LCMapStringW WideCharToMultiByte GetEnvironmentStringsW OpenFile InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind

user32

SetWindowsHookExA TranslateMessage GetMessageA GetDesktopWindow DispatchMessageA GetDC GetWindowRect MessageBoxA UnhookWindowsHookEx GetKeyState GetWindowThreadProcessId GetForegroundWindow CallNextHookEx GetWindowTextA ReleaseDC GetKeyboardLayout OpenClipboard GetClipboardData CloseClipboard

gdi32

GetPixel BitBlt DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetGetConnectedState InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle

winmm

mciSendStringA mciSendCommandA

wsock32

send gethostbyname closesocket socket htons WSAStartup connect

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

generic