5a9e65c50753a9a7d434461cb23de5e8886ecd0cb2390ea32dbe31e3d071e511 | Triage

Sharing

General

Target

f99db15195325e96a2535dbebc3af6c0_NEIKI
Size

656KB
Sample

240508-hckg2afe2s
MD5

f99db15195325e96a2535dbebc3af6c0
SHA1

39968a5fe06830d48fde50c6c4dccb63f340a567
SHA256

5a9e65c50753a9a7d434461cb23de5e8886ecd0cb2390ea32dbe31e3d071e511
SHA512

853ce66aa2e4626bb404f6318bdeb648ef2109d0511b259caf3b7d6b5fe42021d81fa6a41c3635d33fbff4c60065b0239da485a1b47997c98e081dc01df5a963
SSDEEP

12288:xC0SKdBFXReed/QfAU1T3tpsBv9M255i3:DHB59dg3YB62y3

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  f99db15195325e96a2535dbebc3af6c0_NEIKI
- Size
  
  656KB
- MD5
  
  f99db15195325e96a2535dbebc3af6c0
- SHA1
  
  39968a5fe06830d48fde50c6c4dccb63f340a567
- SHA256
  
  5a9e65c50753a9a7d434461cb23de5e8886ecd0cb2390ea32dbe31e3d071e511
- SHA512
  
  853ce66aa2e4626bb404f6318bdeb648ef2109d0511b259caf3b7d6b5fe42021d81fa6a41c3635d33fbff4c60065b0239da485a1b47997c98e081dc01df5a963
- SSDEEP
  
  12288:xC0SKdBFXReed/QfAU1T3tpsBv9M255i3:DHB59dg3YB62y3
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer