98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39

General

Target

21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
Size

6.0MB
Sample

240517-x8wmhafa6s
MD5

21353d65b457518570bffc8a03038ee0
SHA1

b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d
SHA256

98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
SHA512

a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282
SSDEEP

98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS

Score

10^/10

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\HOW_TO_RECOVER_FILES.txt

Ransom Note

Your network has been chosen for Security Audit by EMBARGO Team. We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems. You must contact us before the deadline 2024-05-21 06:25:37 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/ Do not modify any files or file extensions. Your data maybe lost forever. Instructions: 1. Download torbrowser: https://www.torproject.org/download/ 2. Go to your registration link: ================================= http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8 ================================= 3. Register an account then login If you have problems with this instructions, you can contact us on TOX: 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47 After payment for our services, you will receive: - decrypt app for all systems - proof that we delete your data from our systems - full detail pentest report - 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan IMPORTANT: After 2024-05-21 06:25:37 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed. If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers. WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators. If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.

URLs

http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/

http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8

Targets

- Target
  
  21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
- Size
  
  6.0MB
- MD5
  
  21353d65b457518570bffc8a03038ee0
- SHA1
  
  b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d
- SHA256
  
  98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
- SHA512
  
  a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282
- SSDEEP
  
  98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS
Score

10^/10

evasion ransomware spyware stealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (8167) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2