Behavioral task
behavioral1
Sample
d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics
-
Size
956KB
-
MD5
d260bab3f77e21df19a76ff9d9795d50
-
SHA1
f22e0cbc2d344fbd19b12d02320881e53d9e251f
-
SHA256
f562ae4ac6fb307a2e3d0e8ab5af0ac38c3ed238e792550df6d09e0071b8ec55
-
SHA512
287b533ceae2a2c4a3f3a4a1e537dce9c0137789faa057f822d43b05304704f2d798c9b6df05cb3308c815228a86670273354c9d5c07941c3902946fd66972ff
-
SSDEEP
24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxE:dJ5gEKNikf3hBfUiWxE
Malware Config
Signatures
-
AmmyyAdmin payload 1 IoCs
resource yara_rule sample family_ammyyadmin -
Ammyyadmin family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics
Files
-
d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: 512B - Virtual size: 75B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ