General
-
Target
a5e5c31adf7f0d2faa5fc45e0c9e6350_NeikiAnalytics
-
Size
43KB
-
Sample
240515-jh9jsafe5z
-
MD5
a5e5c31adf7f0d2faa5fc45e0c9e6350
-
SHA1
91bdf3803177a61d907384582ce7af13af2f0159
-
SHA256
eb6800fb8c812954f82f25a74ef24c5e7aa55ea78c9044f060c2d6b77bddcf2e
-
SHA512
ef5e7dc964277b71ce80aeb0d631e819a35717fb2e5a32b8fae82c6e2972f2b50e58502dfa5f4789be9d92f621e2a139dc9f679460170201ec02980a3ed80a60
-
SSDEEP
384:GZyZWg98NaIyrXLb3GHaAmE9iE7azsIij+ZsNO3PlpJKkkjh/TzF7pWnZvgreT0k:c+ywFr7b3w/fguXQ/oMP+L
Behavioral task
behavioral1
Sample
a5e5c31adf7f0d2faa5fc45e0c9e6350_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a5e5c31adf7f0d2faa5fc45e0c9e6350_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
Hacker
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
a5e5c31adf7f0d2faa5fc45e0c9e6350_NeikiAnalytics
-
Size
43KB
-
MD5
a5e5c31adf7f0d2faa5fc45e0c9e6350
-
SHA1
91bdf3803177a61d907384582ce7af13af2f0159
-
SHA256
eb6800fb8c812954f82f25a74ef24c5e7aa55ea78c9044f060c2d6b77bddcf2e
-
SHA512
ef5e7dc964277b71ce80aeb0d631e819a35717fb2e5a32b8fae82c6e2972f2b50e58502dfa5f4789be9d92f621e2a139dc9f679460170201ec02980a3ed80a60
-
SSDEEP
384:GZyZWg98NaIyrXLb3GHaAmE9iE7azsIij+ZsNO3PlpJKkkjh/TzF7pWnZvgreT0k:c+ywFr7b3w/fguXQ/oMP+L
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-