Overview

overview

7

Static

static

7

e93da6ea43...KI.exe

windows7-x64

7

e93da6ea43...KI.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    e93da6ea43932ea6ab01bbd0c42b8c70_NEIKI

  • Size

    97KB

  • Sample

    240508-gf9ewsdf8v

  • MD5

    e93da6ea43932ea6ab01bbd0c42b8c70

  • SHA1

    4d4f6a2e75d0bddd5703c0cdcac55986b0d75560

  • SHA256

    3fd3065c1d341506c327fae673ecc005549a32dc376be2de68ef4f9b82b59b28

  • SHA512

    8ed8ae7cf073edc182aa3d4e1f12bd905491c1d761d3b7fdff9cac7609d293d16d4ef2e479c085aa6067d8adf6fdb7a685a8f054f0a4e6961f531a2c14541e98

  • SSDEEP

    3072:W6Ccn27mUC7AdYzrV+Dljy/32ubwZZqJ:W6Ccn2xCkdYzrVolu/J0ZZ

Score
7/10
persistenceupx

Malware Config

Targets

    • Target

      e93da6ea43932ea6ab01bbd0c42b8c70_NEIKI

    • Size

      97KB

    • MD5

      e93da6ea43932ea6ab01bbd0c42b8c70

    • SHA1

      4d4f6a2e75d0bddd5703c0cdcac55986b0d75560

    • SHA256

      3fd3065c1d341506c327fae673ecc005549a32dc376be2de68ef4f9b82b59b28

    • SHA512

      8ed8ae7cf073edc182aa3d4e1f12bd905491c1d761d3b7fdff9cac7609d293d16d4ef2e479c085aa6067d8adf6fdb7a685a8f054f0a4e6961f531a2c14541e98

    • SSDEEP

      3072:W6Ccn27mUC7AdYzrV+Dljy/32ubwZZqJ:W6Ccn2xCkdYzrVolu/J0ZZ

    Score
    7/10
    persistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks