63d07145fae1e853d857b0f1c151e1c74224b79246a8feb901145cdb6a95a7bb | Triage

Sharing

General

Target

2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy
Size

280KB
Sample

240812-awl6zawgrj
MD5

16ea3085de53cf5b77e6a097f0c06739
SHA1

c9a7e031deebd00f5a54a163c9773134eaec0cd4
SHA256

63d07145fae1e853d857b0f1c151e1c74224b79246a8feb901145cdb6a95a7bb
SHA512

b6a868faa17781916ae45d8d2b858a693e8428bc906bb99227011ea407f6a8a04dfb79dd045ff23758bd8e5d6c74d9abf3584e15f8d0e132be3cfebf1db9c328
SSDEEP

6144:JQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:JQMyfmNFHfnWfhLZVHmOog

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy
- Size
  
  280KB
- MD5
  
  16ea3085de53cf5b77e6a097f0c06739
- SHA1
  
  c9a7e031deebd00f5a54a163c9773134eaec0cd4
- SHA256
  
  63d07145fae1e853d857b0f1c151e1c74224b79246a8feb901145cdb6a95a7bb
- SHA512
  
  b6a868faa17781916ae45d8d2b858a693e8428bc906bb99227011ea407f6a8a04dfb79dd045ff23758bd8e5d6c74d9abf3584e15f8d0e132be3cfebf1db9c328
- SSDEEP
  
  6144:JQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:JQMyfmNFHfnWfhLZVHmOog
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2