2110545aa0f71406e9be010c186cbe4291f3949559b3c661f016ed8b3c03547d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b0e886584af2af25d240e3684f740140_NeikiAnalytics
Size

478KB
Sample

240511-nq8pnsed2z
MD5

b0e886584af2af25d240e3684f740140
SHA1

7d11d6f17f787a5b5f9434b697c739b69e7192de
SHA256

2110545aa0f71406e9be010c186cbe4291f3949559b3c661f016ed8b3c03547d
SHA512

242f374375c5b2a70453c2b3b6c95c570e685ab784aef92ab4a444311950a5fcd779aac227d0a161e214e077eeeef692cd5932a3b355c1dd5fdf37a353944633
SSDEEP

12288:VYWHNXcQtpFcZuMrmq5k45Esco+zzSXmvUBAmaJ8II:rtXJtgnrmq5k45Es+saJrI

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  b0e886584af2af25d240e3684f740140_NeikiAnalytics
- Size
  
  478KB
- MD5
  
  b0e886584af2af25d240e3684f740140
- SHA1
  
  7d11d6f17f787a5b5f9434b697c739b69e7192de
- SHA256
  
  2110545aa0f71406e9be010c186cbe4291f3949559b3c661f016ed8b3c03547d
- SHA512
  
  242f374375c5b2a70453c2b3b6c95c570e685ab784aef92ab4a444311950a5fcd779aac227d0a161e214e077eeeef692cd5932a3b355c1dd5fdf37a353944633
- SSDEEP
  
  12288:VYWHNXcQtpFcZuMrmq5k45Esco+zzSXmvUBAmaJ8II:rtXJtgnrmq5k45Es+saJrI
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer