66d9d6de8329fe3300bd9e3551a3f7bdca1be6574d6528b3f4b48a88ca314eb5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-13_a87f472f8b8feaed1b87263e26a60445_mafia_nionspy
Size

655KB
Sample

241013-rqyfgs1cqd
MD5

a87f472f8b8feaed1b87263e26a60445
SHA1

67a747de2ea550aed33baa6e6cfd8db7237e69dc
SHA256

66d9d6de8329fe3300bd9e3551a3f7bdca1be6574d6528b3f4b48a88ca314eb5
SHA512

c40563f3d6cf37e5a6ee501871c595f5a5d9bf69d7beaf64e7043f386deddb506cccc3bd942ddb2de3d3b4b806f7d5f7a389005db7afa1c4ceff90114d4d50a9
SSDEEP

12288:l2TFafJiHCWBWPMjVWrXfn2t2TFafJiHCWBWPMjVWrXfn2A:l2TFU+CWYPMeXfn2t2TFU+CWYPMeXfnn

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2024-10-13_a87f472f8b8feaed1b87263e26a60445_mafia_nionspy
- Size
  
  655KB
- MD5
  
  a87f472f8b8feaed1b87263e26a60445
- SHA1
  
  67a747de2ea550aed33baa6e6cfd8db7237e69dc
- SHA256
  
  66d9d6de8329fe3300bd9e3551a3f7bdca1be6574d6528b3f4b48a88ca314eb5
- SHA512
  
  c40563f3d6cf37e5a6ee501871c595f5a5d9bf69d7beaf64e7043f386deddb506cccc3bd942ddb2de3d3b4b806f7d5f7a389005db7afa1c4ceff90114d4d50a9
- SSDEEP
  
  12288:l2TFafJiHCWBWPMjVWrXfn2t2TFafJiHCWBWPMjVWrXfn2A:l2TFU+CWYPMeXfn2t2TFU+CWYPMeXfnn
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2