Overview

overview

9

Static

static

3

10fd3d2499...KI.exe

windows7-x64

9

10fd3d2499...KI.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    10fd3d2499602a31242efce573ebc410_NEIKI

  • Size

    225KB

  • Sample

    240508-jfyphahf3y

  • MD5

    10fd3d2499602a31242efce573ebc410

  • SHA1

    8a6fd17edc1590fe0fa18e580ffc9d7251ba2e59

  • SHA256

    3e95bc845a5aae57ac4b0b0980b27b7fcf23ea5843d1a5a0ddb9c6dc00fb0c70

  • SHA512

    f90757191d343d81f72b326c3de4fe6be238054ca8d29bb179c48ef3589dac8caa1a5a1aab922447f6dfbb2a0853b4744d41ab325b2567c7b0ee163b41b4ec57

  • SSDEEP

    6144:RqlIyFESWu0SWuGSMqlIyFESWu0SWuGSb:tyeyl

Score
9/10
ransomware

Malware Config

Targets

    • Target

      10fd3d2499602a31242efce573ebc410_NEIKI

    • Size

      225KB

    • MD5

      10fd3d2499602a31242efce573ebc410

    • SHA1

      8a6fd17edc1590fe0fa18e580ffc9d7251ba2e59

    • SHA256

      3e95bc845a5aae57ac4b0b0980b27b7fcf23ea5843d1a5a0ddb9c6dc00fb0c70

    • SHA512

      f90757191d343d81f72b326c3de4fe6be238054ca8d29bb179c48ef3589dac8caa1a5a1aab922447f6dfbb2a0853b4744d41ab325b2567c7b0ee163b41b4ec57

    • SSDEEP

      6144:RqlIyFESWu0SWuGSMqlIyFESWu0SWuGSb:tyeyl

    Score
    9/10
    ransomware

    • Renames multiple (580) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks