Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    086e89c427107ec7733231281f048bd0_NeikiAnalytics

  • Size

    2.9MB

  • Sample

    240512-n47pjagh69

  • MD5

    086e89c427107ec7733231281f048bd0

  • SHA1

    62211e0ad1fba519a98abb121937ed2424269011

  • SHA256

    7e9e1997f679ecf01fb8a737c062d74ce560737bb6ee312a42aef980b42f372e

  • SHA512

    b0861157cfd03fc60b4654b68012d10946f1462e3f12f00f8a86dba42b867abb80dffd27ef6784d3f8130c806ba5a099e79e3cd62932361c828dc93021bbd5fc

  • SSDEEP

    49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkiFGlObLe:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc

Malware Config

Targets

    • Target

      086e89c427107ec7733231281f048bd0_NeikiAnalytics

    • Size

      2.9MB

    • MD5

      086e89c427107ec7733231281f048bd0

    • SHA1

      62211e0ad1fba519a98abb121937ed2424269011

    • SHA256

      7e9e1997f679ecf01fb8a737c062d74ce560737bb6ee312a42aef980b42f372e

    • SHA512

      b0861157cfd03fc60b4654b68012d10946f1462e3f12f00f8a86dba42b867abb80dffd27ef6784d3f8130c806ba5a099e79e3cd62932361c828dc93021bbd5fc

    • SSDEEP

      49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkiFGlObLe:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks