7b309adb82d45270fdd385c60f170519091db5c1a5cc3bbe182817622abc4517 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb6e6ec76abf755b9a495001f534f470_NEIKI
Size

70KB
Sample

240508-spxm8saf7v
MD5

eb6e6ec76abf755b9a495001f534f470
SHA1

6b0da2c88510eb18de0c7df759e4b37b1a867ad4
SHA256

7b309adb82d45270fdd385c60f170519091db5c1a5cc3bbe182817622abc4517
SHA512

58820cb399c7bc3cca994e0585d1788ff849e637d8e88dc0fd1b8c2703dddb92734976dc9150c84e620f2066ced34fd57cf770c49794250e2e7fcb32b3866d28
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8a2E4:Olg35GTslA5t3/w8a2D

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  eb6e6ec76abf755b9a495001f534f470_NEIKI
- Size
  
  70KB
- MD5
  
  eb6e6ec76abf755b9a495001f534f470
- SHA1
  
  6b0da2c88510eb18de0c7df759e4b37b1a867ad4
- SHA256
  
  7b309adb82d45270fdd385c60f170519091db5c1a5cc3bbe182817622abc4517
- SHA512
  
  58820cb399c7bc3cca994e0585d1788ff849e637d8e88dc0fd1b8c2703dddb92734976dc9150c84e620f2066ced34fd57cf770c49794250e2e7fcb32b3866d28
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8a2E4:Olg35GTslA5t3/w8a2D
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan