e50fa43532c6e030439e2d64c900809d20658d87668d5c5348220f16948b1a9e | Triage

Sharing

General

Target

45727dce66b14809567077d53cec3400_NEIKI
Size

3.2MB
Sample

240507-1tb64ahg9z
MD5

45727dce66b14809567077d53cec3400
SHA1

0188682ab8743ae0da9dbc58fa8a71c2074423e2
SHA256

e50fa43532c6e030439e2d64c900809d20658d87668d5c5348220f16948b1a9e
SHA512

22962fa43a18e05e54a2c47c0efd13eb3167a5665dd019e10abc61659c93021d02741aace7b1ba6c144bb122a13b61f2d5c16ccbbf71746da58c668111ec1c89
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpWbVz8eLFcz

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  45727dce66b14809567077d53cec3400_NEIKI
- Size
  
  3.2MB
- MD5
  
  45727dce66b14809567077d53cec3400
- SHA1
  
  0188682ab8743ae0da9dbc58fa8a71c2074423e2
- SHA256
  
  e50fa43532c6e030439e2d64c900809d20658d87668d5c5348220f16948b1a9e
- SHA512
  
  22962fa43a18e05e54a2c47c0efd13eb3167a5665dd019e10abc61659c93021d02741aace7b1ba6c144bb122a13b61f2d5c16ccbbf71746da58c668111ec1c89
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpWbVz8eLFcz
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer