7ef1b76752bbc8f2e96be2e402c146b3ffa238fcee011a926e53a1b921e70039 | Triage

Sharing

General

Target

49ba7e406e599fe608b92966f76afcd0_NeikiAnalytics
Size

170KB
Sample

240510-cpxegada7v
MD5

49ba7e406e599fe608b92966f76afcd0
SHA1

d6bbe65642cc08d6b18a2bd15b040f4d342845fc
SHA256

7ef1b76752bbc8f2e96be2e402c146b3ffa238fcee011a926e53a1b921e70039
SHA512

a3bc9c3bc5323ea31ebcfa5252e3c3377d427a268cf1f2bb76cb4c1d3c93fb4b77bf9b1d3f2b4f6b3350e9b066033952ac90d19de8a1e59305427c886a99a92f
SSDEEP

3072:djzhZWxivgmhbI/pqqsFUCN3R9MI+Q7KJLjIsWEvCK886g4our84hoUS8NIF+bp3:dXC4vgmhbIxs3NBR7MnW+B6g4ourV8Ud

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  49ba7e406e599fe608b92966f76afcd0_NeikiAnalytics
- Size
  
  170KB
- MD5
  
  49ba7e406e599fe608b92966f76afcd0
- SHA1
  
  d6bbe65642cc08d6b18a2bd15b040f4d342845fc
- SHA256
  
  7ef1b76752bbc8f2e96be2e402c146b3ffa238fcee011a926e53a1b921e70039
- SHA512
  
  a3bc9c3bc5323ea31ebcfa5252e3c3377d427a268cf1f2bb76cb4c1d3c93fb4b77bf9b1d3f2b4f6b3350e9b066033952ac90d19de8a1e59305427c886a99a92f
- SSDEEP
  
  3072:djzhZWxivgmhbI/pqqsFUCN3R9MI+Q7KJLjIsWEvCK886g4our84hoUS8NIF+bp3:dXC4vgmhbIxs3NBR7MnW+B6g4ourV8Ud
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer