bf07a71dadcf58e5153e4c96c530e7eb1ad21a92c5bbfd82c9ec9fcf22a733b1 | Triage

Sharing

General

Target

8dfed34fa34222a3fa7d599c2b35ecc0_NEIKI
Size

10.0MB
Sample

240508-nslmxsaf4t
MD5

8dfed34fa34222a3fa7d599c2b35ecc0
SHA1

82b38658abd5a63e8fdf64a5bb43bf7207d2e5d5
SHA256

bf07a71dadcf58e5153e4c96c530e7eb1ad21a92c5bbfd82c9ec9fcf22a733b1
SHA512

6b3d494b99e644d29f53db155651ea7b10f2c38345132f2d644cbb4b55e6b208865d0187d788243adaabac67d33359ff923dfc5b4c19210542d17a4b692e79ba
SSDEEP

196608:Zp5Ekh1kb5RYqF1W903eV4QRM993iObMAR1jQmGYuuLmgri+91P2kjv:75Ekh2FGiW+eGQRe93iObLRS/MLhri6L

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  8dfed34fa34222a3fa7d599c2b35ecc0_NEIKI
- Size
  
  10.0MB
- MD5
  
  8dfed34fa34222a3fa7d599c2b35ecc0
- SHA1
  
  82b38658abd5a63e8fdf64a5bb43bf7207d2e5d5
- SHA256
  
  bf07a71dadcf58e5153e4c96c530e7eb1ad21a92c5bbfd82c9ec9fcf22a733b1
- SHA512
  
  6b3d494b99e644d29f53db155651ea7b10f2c38345132f2d644cbb4b55e6b208865d0187d788243adaabac67d33359ff923dfc5b4c19210542d17a4b692e79ba
- SSDEEP
  
  196608:Zp5Ekh1kb5RYqF1W903eV4QRM993iObMAR1jQmGYuuLmgri+91P2kjv:75Ekh2FGiW+eGQRe93iObLRS/MLhri6L
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2