fc1ea564eafad7123814352535d1471a53cac0e416e6801947732858ed02319e | Triage

Sharing

General

Target

5667595db5de143c0c8c73ad05638120_NeikiAnalytics.exe
Size

3.9MB
Sample

240605-qskfzagf4t
MD5

5667595db5de143c0c8c73ad05638120
SHA1

001d11976500fea3ed2a393ed456fee97cfb570d
SHA256

fc1ea564eafad7123814352535d1471a53cac0e416e6801947732858ed02319e
SHA512

34dfd395b2ed8878a93883418d320898d62b107c7b44efa57b1ec3bb3e2332c85491954aa1969026673f1a2e430dee37a88bb8a05143fcaddf42e5d2e3b6fcab
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSqz8:sxX7QnxrloE5dpUpPbVz8

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  5667595db5de143c0c8c73ad05638120_NeikiAnalytics.exe
- Size
  
  3.9MB
- MD5
  
  5667595db5de143c0c8c73ad05638120
- SHA1
  
  001d11976500fea3ed2a393ed456fee97cfb570d
- SHA256
  
  fc1ea564eafad7123814352535d1471a53cac0e416e6801947732858ed02319e
- SHA512
  
  34dfd395b2ed8878a93883418d320898d62b107c7b44efa57b1ec3bb3e2332c85491954aa1969026673f1a2e430dee37a88bb8a05143fcaddf42e5d2e3b6fcab
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSqz8:sxX7QnxrloE5dpUpPbVz8
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer