Behavioral task
behavioral1
Sample
4810c6f75f072246956f0c1193006310_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
4810c6f75f072246956f0c1193006310_NEIKI
-
Size
1.9MB
-
MD5
4810c6f75f072246956f0c1193006310
-
SHA1
18cdf47bdf2e658ea4034fb763fd6ef422e08b58
-
SHA256
bb39558713c650e66049c67aea1b2ee80745a2fed6da272b8c496ae9bc7e3b5a
-
SHA512
df7029281b573c8c825ab927f0e6f552cf1044e6ea265b0599791fc69bff4a1121fa1a0a59ea1ed30fcfa13ee4d49995d09215bea9c6e1b0d810b3843bf974e0
-
SSDEEP
49152:FGUzr9GOWh50kC1/dVFdNaeUE3LqW1T/f5iBA9R86DHVVzP7ffQmSh:FG6r9GOWPClFdNaeUE3LqW1T/f5iBA9C
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4810c6f75f072246956f0c1193006310_NEIKI
Files
-
4810c6f75f072246956f0c1193006310_NEIKI.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE