Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
405b3f689c9476b0f1ae2399df15a2b0_NeikiAnalytics.exe
-
Size
90KB
-
Sample
240516-1qf1waab7v
-
MD5
405b3f689c9476b0f1ae2399df15a2b0
-
SHA1
41b4b007b170136c2cf9493caf68dfdd34ff69fe
-
SHA256
27fb2a53bcdf943b584e618c52e0e76ed6540c767ea4fc7c3af5d5c3e1701c73
-
SHA512
b1636aebc139fed0f1585bb77d2e1a36edde7189e305ce130858599c4109214305726f7410a2aec55d81658e69d166b96d6a06e300f81bff3e2bd2865662eaf5
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Behavioral task
behavioral1
Sample
405b3f689c9476b0f1ae2399df15a2b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
405b3f689c9476b0f1ae2399df15a2b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
405b3f689c9476b0f1ae2399df15a2b0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
405b3f689c9476b0f1ae2399df15a2b0
-
SHA1
41b4b007b170136c2cf9493caf68dfdd34ff69fe
-
SHA256
27fb2a53bcdf943b584e618c52e0e76ed6540c767ea4fc7c3af5d5c3e1701c73
-
SHA512
b1636aebc139fed0f1585bb77d2e1a36edde7189e305ce130858599c4109214305726f7410a2aec55d81658e69d166b96d6a06e300f81bff3e2bd2865662eaf5
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-