1dc3a9eaa5d69a5cd9f69bb42b32fcf58ae7bb1f3460fa9cdbf85298408fef3b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-27_25cad6ec3aa56b49baa1781ed4e81753_mafia_nionspy
Size

280KB
Sample

240727-mg9d6svamq
MD5

25cad6ec3aa56b49baa1781ed4e81753
SHA1

d0b8e6b3f00dc812e718a78c166ed9a12eca87ef
SHA256

1dc3a9eaa5d69a5cd9f69bb42b32fcf58ae7bb1f3460fa9cdbf85298408fef3b
SHA512

efc05fb92eacbf2f056bfd4160c05f1c08b7317adf20ed2d275b02920a821d2b4dca38b12f120879b03e44f851d1d213b75ff7622182d322a657a1895c8cd145
SSDEEP

6144:eQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:eQMyfmNFHfnWfhLZVHmOog

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-07-27_25cad6ec3aa56b49baa1781ed4e81753_mafia_nionspy
- Size
  
  280KB
- MD5
  
  25cad6ec3aa56b49baa1781ed4e81753
- SHA1
  
  d0b8e6b3f00dc812e718a78c166ed9a12eca87ef
- SHA256
  
  1dc3a9eaa5d69a5cd9f69bb42b32fcf58ae7bb1f3460fa9cdbf85298408fef3b
- SHA512
  
  efc05fb92eacbf2f056bfd4160c05f1c08b7317adf20ed2d275b02920a821d2b4dca38b12f120879b03e44f851d1d213b75ff7622182d322a657a1895c8cd145
- SSDEEP
  
  6144:eQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:eQMyfmNFHfnWfhLZVHmOog
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2