8503820d8eeb5c8167c16f5d7a41ceb028118152840a34f5c494ab6f14bc0ed8 | Triage

Sharing

General

Target

1659e0e555adbfb871cb45a7991cb020_NeikiAnalytics
Size

1.8MB
Sample

240511-s7kfmagh86
MD5

1659e0e555adbfb871cb45a7991cb020
SHA1

19e15317b66e0a281a3a628798bf81b4f0cad16f
SHA256

8503820d8eeb5c8167c16f5d7a41ceb028118152840a34f5c494ab6f14bc0ed8
SHA512

1d152c36c27bf9be879ebe5748bcf5a0a8841212eb28f8014f5310267f137c84e012e1963c67b5b53db4b2266898ea02891a2a494c9e70da984eb4fe19544d8e
SSDEEP

49152:ISwsaJb9D4VHPsDKJG4MT3ThZLrhWo16hkx6XE:E19ctUASLlZZ13x60

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  1659e0e555adbfb871cb45a7991cb020_NeikiAnalytics
- Size
  
  1.8MB
- MD5
  
  1659e0e555adbfb871cb45a7991cb020
- SHA1
  
  19e15317b66e0a281a3a628798bf81b4f0cad16f
- SHA256
  
  8503820d8eeb5c8167c16f5d7a41ceb028118152840a34f5c494ab6f14bc0ed8
- SHA512
  
  1d152c36c27bf9be879ebe5748bcf5a0a8841212eb28f8014f5310267f137c84e012e1963c67b5b53db4b2266898ea02891a2a494c9e70da984eb4fe19544d8e
- SSDEEP
  
  49152:ISwsaJb9D4VHPsDKJG4MT3ThZLrhWo16hkx6XE:E19ctUASLlZZ13x60
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer