2bfe1dde9aab799451338024fa4d67809ef18dc53bea1981a3b8eb9a7865b7fa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

db17b899dfff125c225762104a420320_NEIKI
Size

70KB
Sample

240508-rwvlsabd94
MD5

db17b899dfff125c225762104a420320
SHA1

588bb328f2c726609f2d93adec8244213e82f538
SHA256

2bfe1dde9aab799451338024fa4d67809ef18dc53bea1981a3b8eb9a7865b7fa
SHA512

4bdb621fe382777a26a50c0d63b8a48abdd4d1de445007662a31e17253f143e4a3cd86b72d7596b1d1a5e1f75571679f1d6299332b76b0243207cbc8e4c82a71
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8J:Olg35GTslA5t3/w8J

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  db17b899dfff125c225762104a420320_NEIKI
- Size
  
  70KB
- MD5
  
  db17b899dfff125c225762104a420320
- SHA1
  
  588bb328f2c726609f2d93adec8244213e82f538
- SHA256
  
  2bfe1dde9aab799451338024fa4d67809ef18dc53bea1981a3b8eb9a7865b7fa
- SHA512
  
  4bdb621fe382777a26a50c0d63b8a48abdd4d1de445007662a31e17253f143e4a3cd86b72d7596b1d1a5e1f75571679f1d6299332b76b0243207cbc8e4c82a71
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8J:Olg35GTslA5t3/w8J
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan