General
-
Target
49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics
-
Size
3.1MB
-
Sample
240514-blhapsdg25
-
MD5
49a926d15231ccd4a1e4b0e5a3424bc0
-
SHA1
688bb4c4a54dbdaaa71515b5aa2c6bf158885348
-
SHA256
427fed8301402b5d8191e704cb71032af5ef857f05b2b5f6849e3b427d642227
-
SHA512
751778acd65e6914bc0a7e43bd453ca15e4eb89569901ace74bcbb7fd255a8b86ca0c74e7b8f6052ae7be794f4e8b51b2681d867d74e6925719535a580709b54
-
SSDEEP
49152:PvJAd23law6wGPAllX3SSLNUpywNYB1JjmoGdRTHHB72eh2NT:Pved23law6wGPAllX3bLNUpywNYM
Behavioral task
behavioral1
Sample
49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe
Resource
win7-20240419-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.175:4782
fe80::f835:963e:fc2b:1329%18:4782
172.26.144.1:4782
fe80::9b7e:8bd8:a039:a023%44:4782
d88f0ce9-c5a1-4c26-a21c-6528c04bd2a8
-
encryption_key
43458FB2AA6463FFFA04B58A9920BCC9450BA233
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
javaSP
-
subdirectory
SubDir
Targets
-
-
Target
49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics
-
Size
3.1MB
-
MD5
49a926d15231ccd4a1e4b0e5a3424bc0
-
SHA1
688bb4c4a54dbdaaa71515b5aa2c6bf158885348
-
SHA256
427fed8301402b5d8191e704cb71032af5ef857f05b2b5f6849e3b427d642227
-
SHA512
751778acd65e6914bc0a7e43bd453ca15e4eb89569901ace74bcbb7fd255a8b86ca0c74e7b8f6052ae7be794f4e8b51b2681d867d74e6925719535a580709b54
-
SSDEEP
49152:PvJAd23law6wGPAllX3SSLNUpywNYB1JjmoGdRTHHB72eh2NT:Pved23law6wGPAllX3bLNUpywNYM
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-