General

  • Target

    8c2ab7d7bd20f8a8b92dbe5779ac4320_NEIKI

  • Size

    397KB

  • Sample

    240508-2zzd9acc8s

  • MD5

    8c2ab7d7bd20f8a8b92dbe5779ac4320

  • SHA1

    65c75835b540175d33ab67583f98626711de74e5

  • SHA256

    79d309dcae873685245924766520ef95497e9f4054d9a6540bb0acec36c993ca

  • SHA512

    4a35b2dedb9d391d9cac9952c3526abec496b8215040237bc10f745e769159b44512a7c1d72d07e2b944e97d48247003fc83f22ae2c398fa34662c87f3075195

  • SSDEEP

    12288:vdDU6g13sJd1fm/+yb3O2jg82ydU/DdKumy:vdE3sJd1fm/+yb3OYg84/JHJ

Malware Config

Targets

    • Target

      8c2ab7d7bd20f8a8b92dbe5779ac4320_NEIKI

    • Size

      397KB

    • MD5

      8c2ab7d7bd20f8a8b92dbe5779ac4320

    • SHA1

      65c75835b540175d33ab67583f98626711de74e5

    • SHA256

      79d309dcae873685245924766520ef95497e9f4054d9a6540bb0acec36c993ca

    • SHA512

      4a35b2dedb9d391d9cac9952c3526abec496b8215040237bc10f745e769159b44512a7c1d72d07e2b944e97d48247003fc83f22ae2c398fa34662c87f3075195

    • SSDEEP

      12288:vdDU6g13sJd1fm/+yb3O2jg82ydU/DdKumy:vdE3sJd1fm/+yb3OYg84/JHJ

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks