9e130ec61995d58efd030ab1a5e6fbe09437cb9eb672ab9656ad9209e5c2161d | Triage

Sharing

General

Target

46f7546f3d9cbc5253c3561d8a433d30_NEIKI
Size

3.2MB
Sample

240507-1wt5paaa5v
MD5

46f7546f3d9cbc5253c3561d8a433d30
SHA1

a7464e5dee09f3c5b56498d6053413487032b921
SHA256

9e130ec61995d58efd030ab1a5e6fbe09437cb9eb672ab9656ad9209e5c2161d
SHA512

0fbb79b0ba740501eb5defa7ddd2ecbc7fcae2545ce5fd597b36dd91896af3481e4fbd8a7b6b1646c26092355ff9395acc1fb972c791b6449ab119bf00a15a80
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpdbVz8eLFcz

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  46f7546f3d9cbc5253c3561d8a433d30_NEIKI
- Size
  
  3.2MB
- MD5
  
  46f7546f3d9cbc5253c3561d8a433d30
- SHA1
  
  a7464e5dee09f3c5b56498d6053413487032b921
- SHA256
  
  9e130ec61995d58efd030ab1a5e6fbe09437cb9eb672ab9656ad9209e5c2161d
- SHA512
  
  0fbb79b0ba740501eb5defa7ddd2ecbc7fcae2545ce5fd597b36dd91896af3481e4fbd8a7b6b1646c26092355ff9395acc1fb972c791b6449ab119bf00a15a80
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpdbVz8eLFcz
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer