General
-
Target
7be930f38a9e53a54cacc4a82173fa10_NEIKI
-
Size
5.1MB
-
Sample
240508-atkv5abf62
-
MD5
7be930f38a9e53a54cacc4a82173fa10
-
SHA1
cd546cf2788fb107ad8557e6f4b568d7ff46410e
-
SHA256
27df2c1ab70647bd678c81aa8f8cfba74917f717716d8bd62831265a6bd9a938
-
SHA512
50f2be660b56503a5d68683eb0bf78ff5d0886d453a9f9b24e31ac75f866f18a672c87a009adee4546562f4174d92fba2f0f523d5f256e6c9c69220485bd94b2
-
SSDEEP
98304:04w1yBjOwo8WzLwt5yxPnvcTtLRTQLE1wJjG3qnHhuIBqg/QkqXbN/npbiPHsU63:06dOwonseP+Y5G/IBqcWB/4PH0VpMYZv
Behavioral task
behavioral1
Sample
7be930f38a9e53a54cacc4a82173fa10_NEIKI.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7be930f38a9e53a54cacc4a82173fa10_NEIKI.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
njrat
im523
HacKed
asthbalhacker.ddns.net:5552
78d02b5c475533ad161aec928d88af66
-
reg_key
78d02b5c475533ad161aec928d88af66
-
splitter
|'|'|
Targets
-
-
Target
7be930f38a9e53a54cacc4a82173fa10_NEIKI
-
Size
5.1MB
-
MD5
7be930f38a9e53a54cacc4a82173fa10
-
SHA1
cd546cf2788fb107ad8557e6f4b568d7ff46410e
-
SHA256
27df2c1ab70647bd678c81aa8f8cfba74917f717716d8bd62831265a6bd9a938
-
SHA512
50f2be660b56503a5d68683eb0bf78ff5d0886d453a9f9b24e31ac75f866f18a672c87a009adee4546562f4174d92fba2f0f523d5f256e6c9c69220485bd94b2
-
SSDEEP
98304:04w1yBjOwo8WzLwt5yxPnvcTtLRTQLE1wJjG3qnHhuIBqg/QkqXbN/npbiPHsU63:06dOwonseP+Y5G/IBqcWB/4PH0VpMYZv
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1