2a56bf01e528834b659260ebef64413e1af5ca499a56379dadb1f475b4c0e559 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20499004df79620ffdd06e8dc67f8310_NEIKI
Size

6.4MB
Sample

240508-jz9acadc63
MD5

20499004df79620ffdd06e8dc67f8310
SHA1

2c9fa0767bf22da0580528b702ff684a6e6306ad
SHA256

2a56bf01e528834b659260ebef64413e1af5ca499a56379dadb1f475b4c0e559
SHA512

e42160b6c94de3b85e7730f1ad111116b29c74ef4b07d643e2b9c33fe5eed350a45687cff28ae43e29bb8f5ce437e44ea0590c337e7e81ec2ba66c050c6e5c0d
SSDEEP

98304:JBOM8VfWVLiKwoPllMWHu5iQ3s+1mVp0rfBiO52uTACITf2307C5sfRZqQrKfWNT:OMs5boP1HSsimvlG2xCs2lU3NDok

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  20499004df79620ffdd06e8dc67f8310_NEIKI
- Size
  
  6.4MB
- MD5
  
  20499004df79620ffdd06e8dc67f8310
- SHA1
  
  2c9fa0767bf22da0580528b702ff684a6e6306ad
- SHA256
  
  2a56bf01e528834b659260ebef64413e1af5ca499a56379dadb1f475b4c0e559
- SHA512
  
  e42160b6c94de3b85e7730f1ad111116b29c74ef4b07d643e2b9c33fe5eed350a45687cff28ae43e29bb8f5ce437e44ea0590c337e7e81ec2ba66c050c6e5c0d
- SSDEEP
  
  98304:JBOM8VfWVLiKwoPllMWHu5iQ3s+1mVp0rfBiO52uTACITf2307C5sfRZqQrKfWNT:OMs5boP1HSsimvlG2xCs2lU3NDok
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2