952ae4ee3d533d8f0d53f32eb0ec51cefea50bf4562964b4caf712d424d3d067 | Triage

Sharing

General

Target

2024-08-08_0e47f02c5eb1a762e7aedd459f424ef6_mafia_nionspy
Size

274KB
Sample

240808-mrcsyssemp
MD5

0e47f02c5eb1a762e7aedd459f424ef6
SHA1

4952a4e27c30e75fb45b40bf92566ec0bd1de3f1
SHA256

952ae4ee3d533d8f0d53f32eb0ec51cefea50bf4562964b4caf712d424d3d067
SHA512

980cd7a3aff9766b9a86e3b56c095acbd7d3d18cd28be86b0276fc6b5daf9790bb071aa5d0c27d802b840b144f53091bc4def3c0ca9235a249783312877a8cfb
SSDEEP

6144:MYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:MYvEbrUjp3SpWggd3JBPlPDIQ3g

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-08-08_0e47f02c5eb1a762e7aedd459f424ef6_mafia_nionspy
- Size
  
  274KB
- MD5
  
  0e47f02c5eb1a762e7aedd459f424ef6
- SHA1
  
  4952a4e27c30e75fb45b40bf92566ec0bd1de3f1
- SHA256
  
  952ae4ee3d533d8f0d53f32eb0ec51cefea50bf4562964b4caf712d424d3d067
- SHA512
  
  980cd7a3aff9766b9a86e3b56c095acbd7d3d18cd28be86b0276fc6b5daf9790bb071aa5d0c27d802b840b144f53091bc4def3c0ca9235a249783312877a8cfb
- SSDEEP
  
  6144:MYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:MYvEbrUjp3SpWggd3JBPlPDIQ3g
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2