Behavioral task
behavioral1
Sample
25cf807cad3d3c5d189ecbb4733d1420_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
25cf807cad3d3c5d189ecbb4733d1420_NEIKI
-
Size
3.0MB
-
MD5
25cf807cad3d3c5d189ecbb4733d1420
-
SHA1
c98b4ecc5f64e59d7944ded97589623233edb37a
-
SHA256
d51046881b92a21c2a460fdaeda106a773bb9a3c57cf4408ab6b322016196c23
-
SHA512
9533ef6bb5abe77a56f854af3f72e0dcfc37cd2973e8f86f5f7e081aa9792314b6cbe1f87f8493112ba2ec5837ab9d9aae83786c8fd6631d7486b350d94e0a0f
-
SSDEEP
98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40T:NFWPClFkT
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25cf807cad3d3c5d189ecbb4733d1420_NEIKI
Files
-
25cf807cad3d3c5d189ecbb4733d1420_NEIKI.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE