Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    daeb2e0e8daa69b0f36c808995a93080_NeikiAnalytics

  • Size

    3.3MB

  • Sample

    240510-n9ln9agf66

  • MD5

    daeb2e0e8daa69b0f36c808995a93080

  • SHA1

    907498436ef845c53707e8b4caa0205b995f16f5

  • SHA256

    516be2e243417ba11714f007299b4e5c5fd356d2353878c80b0f296891eac3ab

  • SHA512

    645252f4e9031b5bcf909172187c798084c85a6553e21baaf2a0aeb8d7f51af6557a7c073879e78f29d0daf22222cd92e2792b3ac48a134a6738b7e97c3c2f50

  • SSDEEP

    98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:SbBeSFkd

Malware Config

Targets

    • Target

      daeb2e0e8daa69b0f36c808995a93080_NeikiAnalytics

    • Size

      3.3MB

    • MD5

      daeb2e0e8daa69b0f36c808995a93080

    • SHA1

      907498436ef845c53707e8b4caa0205b995f16f5

    • SHA256

      516be2e243417ba11714f007299b4e5c5fd356d2353878c80b0f296891eac3ab

    • SHA512

      645252f4e9031b5bcf909172187c798084c85a6553e21baaf2a0aeb8d7f51af6557a7c073879e78f29d0daf22222cd92e2792b3ac48a134a6738b7e97c3c2f50

    • SSDEEP

      98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:SbBeSFkd

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks