2024-06-03_c5ca130f855047362fce4f5defc37886_mafia_nionspy

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-03_c5ca130f855047362fce4f5defc37886_mafia_nionspy
Size 348KB
Sample240603-nw8a4adc81
SHA256 547e5e4bef334a1744fb9db428e570445627b778f3e17012bcf27ab93ae0be5f
MD5 c5ca130f855047362fce4f5defc37886
SHA1 19c3faef92e927e102531c70aff767f1b40ffea8
SHA512 2d38112837e0f8d45a3daecd17dce3cf3524b3aede25cf48b52b06800ae78f61647229844d5c1cb03e6bd5abb6da6b67e66df9cf02cd6b25977274130e43970e
SSDEEP 6144:v2+JS2sFZfI8U0obHCW/2a7XQcsPMjVWr289gkPzDhmv:v2TFZfJiHCWBWPMjVWrHfmv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_c5ca130f855047362fce4f5defc37886_mafia_nionspy

File Explorer

2024-06-03_c5ca130f855047362fce4f5defc37886_mafia_nionspy

.exe 348KB

2024-06-03_c5ca130f855047362fce4f5defc37886_mafia_nionspy

IMPHASH db7fd855f8d56ae5e931f5ee272b9c85
SHA256 547e5e4bef334a1744fb9db428e570445627b778f3e17012bcf27ab93ae0be5f
MD5 c5ca130f855047362fce4f5defc37886
SHA1 19c3faef92e927e102531c70aff767f1b40ffea8
SHA512 2d38112837e0f8d45a3daecd17dce3cf3524b3aede25cf48b52b06800ae78f61647229844d5c1cb03e6bd5abb6da6b67e66df9cf02cd6b25977274130e43970e
SSDEEP 6144:v2+JS2sFZfI8U0obHCW/2a7XQcsPMjVWr289gkPzDhmv:v2TFZfJiHCWBWPMjVWrHfmv
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime GetDriveTypeA CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GlobalLock GlobalUnlock GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId TerminateProcess GetEnvironmentStringsW FreeEnvironmentStringsW CreatePipe GetFileAttributesA OpenProcess Process32First EndUpdateResourceA LoadLibraryExA BeginUpdateResourceA LockResource UpdateResourceA LoadResource FreeLibrary FreeResource FindResourceA CloseHandle GetFileTime SetFileTime GetLocaleInfoW LoadLibraryW IsValidCodePage GetOEMCP GetACP HeapSize GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate IsProcessorFeaturePresent GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError GetProcessHeap TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter OpenFile InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA DuplicateHandle GetCurrentProcess GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo

user32

SetWindowsHookExA TranslateMessage GetMessageA GetDesktopWindow DispatchMessageA GetDC GetWindowRect MessageBoxA UnhookWindowsHookEx GetKeyState GetForegroundWindow CallNextHookEx GetWindowTextA ReleaseDC OpenClipboard GetKeyboardLayout GetClipboardData GetWindowThreadProcessId CloseClipboard

gdi32

GetPixel BitBlt DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

HttpSendRequestA InternetConnectA InternetReadFile HttpOpenRequestA InternetGetConnectedState InternetCloseHandle InternetOpenA

winmm

mciSendStringA

wsock32

gethostbyname send closesocket socket recv htons WSAStartup connect

iphlpapi

GetAdaptersInfo

Name

.text

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-03_c5ca130f855047362fce4f5defc37886_mafia_nionspy

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

generic