2024-06-13_665e7a7f98667cb025a4c646b85783c2_mafia_nionspy

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_665e7a7f98667cb025a4c646b85783c2_mafia_nionspy
Size 274KB
Sample240613-dcp1asvhnm
SHA256 f675a6ffa2b1271306968ecb0b314b6addf9a0dc15f5d43359a9ed7310992201
MD5 665e7a7f98667cb025a4c646b85783c2
SHA1 88d5753cc6878a827e07fb3297f34a3a5e26601a
SHA512 9d69f39307312aa0a529cf5cf4287acfe12c9d7af9e87efd06d5e26fb22dc67a6526772d35e8691c728d00f1c24ec4e33d513546f1b84c5175da59f5cb8b42e6
SSDEEP 6144:2YvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:2YvEbrUjp3SpWggd3JBPlPDIQ3g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_665e7a7f98667cb025a4c646b85783c2_mafia_nionspy

File Explorer

2024-06-13_665e7a7f98667cb025a4c646b85783c2_mafia_nionspy

.exe 274KB

2024-06-13_665e7a7f98667cb025a4c646b85783c2_mafia_nionspy

IMPHASH 45d43874d976e18d5fe2a31f451732e5
SHA256 f675a6ffa2b1271306968ecb0b314b6addf9a0dc15f5d43359a9ed7310992201
MD5 665e7a7f98667cb025a4c646b85783c2
SHA1 88d5753cc6878a827e07fb3297f34a3a5e26601a
SHA512 9d69f39307312aa0a529cf5cf4287acfe12c9d7af9e87efd06d5e26fb22dc67a6526772d35e8691c728d00f1c24ec4e33d513546f1b84c5175da59f5cb8b42e6
SSDEEP 6144:2YvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:2YvEbrUjp3SpWggd3JBPlPDIQ3g
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

141254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32First OpenProcess TerminateProcess Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread EndUpdateResourceA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock GlobalUnlock GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale LoadLibraryExA BeginUpdateResourceA LockResource SizeofResource UpdateResourceA FreeLibrary LoadResource FreeResource FindResourceA CloseHandle GetFileTime SetFileTime CreateFileA OpenFile EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW LoadLibraryW IsValidCodePage GetOEMCP GetACP GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetProcessHeap GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize TlsAlloc

user32

CloseClipboard GetClipboardData OpenClipboard MessageBoxA GetWindowRect GetDesktopWindow ReleaseDC GetDC

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit VariantClear

shlwapi

PathFileExistsA

wininet

HttpOpenRequestA InternetGetConnectedState InternetConnectA HttpSendRequestA InternetReadFile InternetOpenA InternetCloseHandle

winmm

mciSendStringA mciSendCommandA

wsock32

gethostbyname htons WSAStartup connect socket send closesocket

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-13_665e7a7f98667cb025a4c646b85783c2_mafia_nionspy

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic