3d4286899570d32244d6bca704956c6f940b0c26926d4c3d668ec2ac4035d273 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29108100c28134f043b4c3b72243de30_NeikiAnalytics.exe
Size

3.2MB
Sample

240617-bat55awgmd
MD5

29108100c28134f043b4c3b72243de30
SHA1

0080f93c5f6422bee26dbfe188cc1aa32742a3de
SHA256

3d4286899570d32244d6bca704956c6f940b0c26926d4c3d668ec2ac4035d273
SHA512

cf3ac2a05921e13663388da350f44f85ebcda571890df1526e2154fabf16315bf523d33eca85ccba5bf3205b56770c1220f5ae5b5c9a74f83d8555c2802f60ef
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpKbVz8eLFcz

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  29108100c28134f043b4c3b72243de30_NeikiAnalytics.exe
- Size
  
  3.2MB
- MD5
  
  29108100c28134f043b4c3b72243de30
- SHA1
  
  0080f93c5f6422bee26dbfe188cc1aa32742a3de
- SHA256
  
  3d4286899570d32244d6bca704956c6f940b0c26926d4c3d668ec2ac4035d273
- SHA512
  
  cf3ac2a05921e13663388da350f44f85ebcda571890df1526e2154fabf16315bf523d33eca85ccba5bf3205b56770c1220f5ae5b5c9a74f83d8555c2802f60ef
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpKbVz8eLFcz
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer