371536588d0427afdb712ab10c932d777bf3bb3176e2b04ddf9ec0ab3b97da53 | Triage

Sharing

General

Target

2024-08-09_6bfcce842df627e553f4bbc8ca955edf_mafia_nionspy
Size

344KB
Sample

240809-ll6cmsygnp
MD5

6bfcce842df627e553f4bbc8ca955edf
SHA1

c83107bf83eadacd88cd17e7be003343f07f09de
SHA256

371536588d0427afdb712ab10c932d777bf3bb3176e2b04ddf9ec0ab3b97da53
SHA512

66921312470ca8a01581715bb87149a664b14477e41176941415e0f2e2c891d69195d9a55adc6ca8a1d506c33bc8615ef635310a292369936108ba507b8a6440
SSDEEP

6144:ETz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:ETBPFV0RyWl3h2E+7pYm0

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-08-09_6bfcce842df627e553f4bbc8ca955edf_mafia_nionspy
- Size
  
  344KB
- MD5
  
  6bfcce842df627e553f4bbc8ca955edf
- SHA1
  
  c83107bf83eadacd88cd17e7be003343f07f09de
- SHA256
  
  371536588d0427afdb712ab10c932d777bf3bb3176e2b04ddf9ec0ab3b97da53
- SHA512
  
  66921312470ca8a01581715bb87149a664b14477e41176941415e0f2e2c891d69195d9a55adc6ca8a1d506c33bc8615ef635310a292369936108ba507b8a6440
- SSDEEP
  
  6144:ETz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:ETBPFV0RyWl3h2E+7pYm0
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2