NikiTeaR
- Malware type
- rat, screen-capture, loader, dropper
- Profile updated
- 2026-07-07 14:54:21
Targeted industries: government-and-public-sector defense-and-aerospace
Context
NikiTeaR is a sophisticated, custom-developed RAT, which is a rewritten variant of the NikiHTTP (aka NikiTea) RAT. It supports the following commands: - srun : Executing arbitrary commands with elevated privileges. - up/down : Performing remote file operations (upload/download). - screen: Capturing screenshots for reconnaissance. - conn : Establishing a reverse shell - memload : Loading additional DLL into memory. - die : Terminates the process and remove trace It is delivered via a multi-staged execution chain, beginning with a Golang-based dropper that executes a loader, a DLL with the internal name MemLoad_V3.dll, capable of loading DLL reflectively. Its internal DLL name is httptroy_dll.dll. To resist analysis, the backdoor is heavily obfuscated; it utilizes custom hashing to conceal Windows API calls, and employs a combined Base64+XOR encryption for C&C traffic and internal character strings, which are dynamically reconstructed at runtime.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Nikitear_Auto (yara-rule)
Reports & references
- gendigital.com — Dprk Kimsuky Lazarus Analysis (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Nikitear (report)
- x.com — 1990797174469198029 (report)