Skip to content
MalwareWiki

Malware

NikiTeaR

NikiTeaR is a sophisticated, custom-developed RAT, which is a rewritten variant of the NikiHTTP (aka NikiTea) RAT.

NikiTeaR is a Windows malware family operated by Kimsuky.

Background

NikiTeaR is an advanced, bespoke RAT that reworks the earlier NikiHTTP (also called NikiTea) RAT.

It supports the following commands:

  • srun <EXEC> <ARGS>: Executing arbitrary commands with elevated privileges.
  • up/down <FILENAME>: Performing remote file operations (upload/download).
  • screen: Capturing screenshots for reconnaissance.
  • conn <IP_ADDRESS> <PORT>: Establishing a reverse shell
  • memload <EXPORT>: Loading additional DLL into memory.
  • die <COMMAND>: Terminates the process and remove trace

Deployment relies on a multi-stage chain that starts with a Golang dropper, which launches a loader DLL named internally MemLoad_V3.dll that performs reflective DLL loading.

The backdoor's own internal DLL name is httptroy_dll.dll.

For anti-analysis, it is heavily obfuscated: Windows API calls are hidden behind custom hashing, while both C&C traffic and embedded strings are protected with a Base64+XOR scheme and rebuilt on the fly at runtime.

Source: Malpedia (Fraunhofer FKIE).