Behavioral task
behavioral1
Sample
16f4c04d32518e7b67d7837030fc1c90_NEIKI.exe
Resource
win7-20240220-en
General
-
Target
16f4c04d32518e7b67d7837030fc1c90_NEIKI
-
Size
1.9MB
-
MD5
16f4c04d32518e7b67d7837030fc1c90
-
SHA1
3c62f3ba50dfcd2be6009acaad5032cde82a2580
-
SHA256
2619abe367bf211a97203fb6a071343f4e3cd21a8f372960029f926ea037f212
-
SHA512
21b0133b7744db841170133efeb0c493f4a601b4fcfa44d29339ff4cad8aa1731998ff5560cedff8eabeecc2c3088ff7331d9337f32f2c04f22eab13f891116a
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wINF/A1B8ii:BemTLkNdfE0pZrV
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16f4c04d32518e7b67d7837030fc1c90_NEIKI
Files
-
16f4c04d32518e7b67d7837030fc1c90_NEIKI.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE