General

  • Target

    b1690a811a2e95ab4e43070367720ef0_NeikiAnalytics

  • Size

    6.3MB

  • Sample

    240513-l7vs2aaf86

  • MD5

    b1690a811a2e95ab4e43070367720ef0

  • SHA1

    f16e51813a1fb49ea8fbe76281995d272ab9ee16

  • SHA256

    7e48965b50f74d8e98676699b3a905ab53ded5003a2977a97b889252a450f57e

  • SHA512

    929d621ce6d5d01ea50bcba8bb0af08a6909e8fdbae225080d9d5c2b357dea54babc0ad1db2b6d79848b2cbc977a01a47dcf8a42479e132f17e3cab1bbf28b83

  • SSDEEP

    196608:po6wY3lzt3cINQscNmvLCwDkHEvZ/4R79l:p+Y15bNvICCwEEh/c

Score
10/10

Malware Config

Targets

    • Target

      b1690a811a2e95ab4e43070367720ef0_NeikiAnalytics

    • Size

      6.3MB

    • MD5

      b1690a811a2e95ab4e43070367720ef0

    • SHA1

      f16e51813a1fb49ea8fbe76281995d272ab9ee16

    • SHA256

      7e48965b50f74d8e98676699b3a905ab53ded5003a2977a97b889252a450f57e

    • SHA512

      929d621ce6d5d01ea50bcba8bb0af08a6909e8fdbae225080d9d5c2b357dea54babc0ad1db2b6d79848b2cbc977a01a47dcf8a42479e132f17e3cab1bbf28b83

    • SSDEEP

      196608:po6wY3lzt3cINQscNmvLCwDkHEvZ/4R79l:p+Y15bNvICCwEEh/c

    Score
    10/10
    • Modifies visiblity of hidden/system files in Explorer

    • Modifies AppInit DLL entries

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks