Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

e97a8615e0...KI.exe

windows7-x64

7

e97a8615e0...KI.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e97a8615e0d5ff74d21d9d79b7e1d2c0_NEIKI

  • Size

    1.2MB

  • Sample

    240508-ggpf4sgc86

  • MD5

    e97a8615e0d5ff74d21d9d79b7e1d2c0

  • SHA1

    1e3e933b5efc8b533402a0ed37e0eca20bbbd42e

  • SHA256

    f22bd38a1dde0a5c0b6d28af66574277333bb9553780801ffcb7b3dccbe11aea

  • SHA512

    596903d4b260c537bf5bdc5e761c17fa5280c4e6ce54d6113e1bfb5f78344c1c35e155c84f9aaf74c1ede3b1a97cb403a36b9a45cd10872e179507030a874435

  • SSDEEP

    24576:lq89J7l75rJsl3Rj0Pt3ZDnCXquGJpJz8wBLAblH5mkP1yTjVYP9SIiH:lx9gl3t43ZEqu0pJQwyR53P1yloAIiH

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      e97a8615e0d5ff74d21d9d79b7e1d2c0_NEIKI

    • Size

      1.2MB

    • MD5

      e97a8615e0d5ff74d21d9d79b7e1d2c0

    • SHA1

      1e3e933b5efc8b533402a0ed37e0eca20bbbd42e

    • SHA256

      f22bd38a1dde0a5c0b6d28af66574277333bb9553780801ffcb7b3dccbe11aea

    • SHA512

      596903d4b260c537bf5bdc5e761c17fa5280c4e6ce54d6113e1bfb5f78344c1c35e155c84f9aaf74c1ede3b1a97cb403a36b9a45cd10872e179507030a874435

    • SSDEEP

      24576:lq89J7l75rJsl3Rj0Pt3ZDnCXquGJpJz8wBLAblH5mkP1yTjVYP9SIiH:lx9gl3t43ZEqu0pJQwyR53P1yloAIiH

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks