neoreklami | 06a0171a18a1b379f36fedba70c7259716ea72a548d17a57a4917475d18bfd33

General

Target
jaffacakes118_06a0171a18a1b379f36fedba70c7259716ea72a548d17a57a4917475d18bfd33.bin
Size 7.2MB
Sample260909-3ye5naeb72
SHA256 06a0171a18a1b379f36fedba70c7259716ea72a548d17a57a4917475d18bfd33
MD5 76ac6bcc8ca38c61d529801ad0f02338
SHA1 5ea40d0e527469c8e1563b5fcae1eab0aab6b942
SHA512 9697b1719d5df09637715cd3d8cc674e7cf5b513a3939cb9669603d5d2dee41447c7a7ae326a7e7f6eb520a8068d96cd855da9fc484ff8ba364afaf39fbfbbe5
SSDEEP 196608:P1OjjdL/6r+U/W5MyogEP18/mpLcCIxXuXuncM6Ra9iBYdf:tOjjdb6rtbgEtImpI/xKucvRa9iSN
TLSH
T12E7633A072F854F3C5148031FA667EAF97F897B50A3510A74B65222F273F8E8C65B394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_06a0171a18a1b379f36fedba70c7259716ea72a548d17a57a4917475d18bfd33.bin
- Size 7.2MB
- SHA256 06a0171a18a1b379f36fedba70c7259716ea72a548d17a57a4917475d18bfd33
- MD5 76ac6bcc8ca38c61d529801ad0f02338
- SHA1 5ea40d0e527469c8e1563b5fcae1eab0aab6b942
- SHA512 9697b1719d5df09637715cd3d8cc674e7cf5b513a3939cb9669603d5d2dee41447c7a7ae326a7e7f6eb520a8068d96cd855da9fc484ff8ba364afaf39fbfbbe5
- SSDEEP 196608:P1OjjdL/6r+U/W5MyogEP18/mpLcCIxXuXuncM6Ra9iBYdf:tOjjdb6rtbgEtImpI/xKucvRa9iSN
- TLSH
  T12E7633A072F854F3C5148031FA667EAF97F897B50A3510A74B65222F273F8E8C65B394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution neoreklami persistence privilege_escalation spyware stealer trojan
- Detects Neoreklami Adware installer
- Family: Neoreklami
  Neoreklami is a Windows adware and trojan.
  adware trojan neoreklami
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2