CHALLENGE LAB 02PRACTICAL MALWARE ANALYSIS (PMAT)DIFFICULTY: INTERMEDIATE

SikoMode.exe: Nim-Compiled Stealer & RC4 Decryption

Reverse engineer an evasive 64-bit Nim-compiled information stealer, bypass anti-debugging traps, and decrypt exfiltrated RC4 payloads.

Lab Progress

0% (0/4 Verified)

Threat Actor Profile: Nim Infostealer Campaign

Modern threat actors increasingly utilize emerging compiled languages such as Nim, Rust, and Go to evade traditional signature-based Endpoint Detection and Response (EDR) solutions. Nim compiles down to intermediate C code, producing bloated PE binaries with custom memory allocators that confuse traditional heuristic analyzers.

SikoMode.exe inspects host browsers, steals saved credentials, encrypts the stolen data in-memory using an RC4 stream cipher, and transmits it via HTTP POST to update.kbfirewall.com.

Analyst Learning Objectives

Identify Nim Signatures

Recognize Nim runtime bootstrap symbols, garbage collection routines, and string wrappers.

Bypass IsDebuggerPresent

Patch PEB BeingDebugged flag or NOP the conditional jump in x64dbg.

Locate Hardcoded RC4 Key

Extract the passphrase 'sikomode' from the encryption routine parameters.

Decode Captured HTTP Post PCAP

Decrypt exfiltrated credential payloads to assess enterprise data breach impact.

Sample Telemetry

SHA256:9ef39b6b...1829

Compiler:Nim v1.4.8 → GCC x64

File Size:680 KB

Risk Rating:89 / 100 (HIGH)

Threat Capabilities

• Nim-Compiled Obfuscated Binary

• RC4 Encryption with Hardcoded Passphrase

• Dynamic C2 Callback & Beaconing

• Credential & File Exfiltration via HTTP POST

• Anti-Debugging (IsDebuggerPresent checks)