8458d5a9ca0c29e58bf4d7aa4213ba2be3d408eb0ebe06ab7626b4be6b664084 | Triage

Sharing

General

Target

2024-08-18_df9e825c62c2d6f8aa6ee405a0ddd1cc_mafia_nionspy
Size

280KB
Sample

240818-lkb3eazglj
MD5

df9e825c62c2d6f8aa6ee405a0ddd1cc
SHA1

9215357aed815f10364c2a028e86b42a0326651a
SHA256

8458d5a9ca0c29e58bf4d7aa4213ba2be3d408eb0ebe06ab7626b4be6b664084
SHA512

a8e61bccacdbac3f7c2a914c310e62af71d23282e5bd6a6a128493ebe448b1050e416fb05f1a27a29ccd5487708d4b791b493d2ec6e67273f4c6301375fa02ef
SSDEEP

6144:6Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:6QMyfmNFHfnWfhLZVHmOog

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-08-18_df9e825c62c2d6f8aa6ee405a0ddd1cc_mafia_nionspy
- Size
  
  280KB
- MD5
  
  df9e825c62c2d6f8aa6ee405a0ddd1cc
- SHA1
  
  9215357aed815f10364c2a028e86b42a0326651a
- SHA256
  
  8458d5a9ca0c29e58bf4d7aa4213ba2be3d408eb0ebe06ab7626b4be6b664084
- SHA512
  
  a8e61bccacdbac3f7c2a914c310e62af71d23282e5bd6a6a128493ebe448b1050e416fb05f1a27a29ccd5487708d4b791b493d2ec6e67273f4c6301375fa02ef
- SSDEEP
  
  6144:6Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:6QMyfmNFHfnWfhLZVHmOog
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2