Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0cf95bfc8dba4c9824685c891b7f6000_NEIKI

  • Size

    3.2MB

  • Sample

    240508-xb5h5sca24

  • MD5

    0cf95bfc8dba4c9824685c891b7f6000

  • SHA1

    b859ba5029062be846711e2f4b8b975e2f823341

  • SHA256

    7e1c292c7a8756fbff74cd5b604c0482ad1856ddf6c18411f9560b6c6f9fd784

  • SHA512

    bb6cee69581f6188200b95f9374214427af40153a1d19f5dfc13d92dd7599d1fa0c46e4a5a605ded2f80e327b24026e85b7c4349409c0415d7a03f76e14056e3

  • SSDEEP

    98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:SbBeSFkT

Malware Config

Targets

    • Target

      0cf95bfc8dba4c9824685c891b7f6000_NEIKI

    • Size

      3.2MB

    • MD5

      0cf95bfc8dba4c9824685c891b7f6000

    • SHA1

      b859ba5029062be846711e2f4b8b975e2f823341

    • SHA256

      7e1c292c7a8756fbff74cd5b604c0482ad1856ddf6c18411f9560b6c6f9fd784

    • SHA512

      bb6cee69581f6188200b95f9374214427af40153a1d19f5dfc13d92dd7599d1fa0c46e4a5a605ded2f80e327b24026e85b7c4349409c0415d7a03f76e14056e3

    • SSDEEP

      98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:SbBeSFkT

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks