General
-
Target
17888a2c90547f557c1f88877d7353e0_NeikiAnalytics.exe
-
Size
619KB
-
Sample
240517-xfxn4adc2z
-
MD5
17888a2c90547f557c1f88877d7353e0
-
SHA1
582760951fd4418ec3f949ab5d55a53ce578203d
-
SHA256
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d
-
SHA512
cfe1ecc5b4e011e0f1281568519dbaf6b8b9bb73bd1a8d8fbc8547c2a846a24a2f7ccc273d182a086136c3689674fe74b1784717bcf094504e95fc4f4d67ca1d
-
SSDEEP
12288:iw2iN3skSKSIwpdj6kxlApT9NUYzKoXKMXPK6QD0GD7k0nVXB:iw19JSNIAdLL0WwhX8dvB
Static task
static1
Behavioral task
behavioral1
Sample
17888a2c90547f557c1f88877d7353e0_NeikiAnalytics.exe
Resource
win7-20240221-en
Malware Config
Extracted
redline
3
94.156.8.28:65012
Targets
-
-
Target
17888a2c90547f557c1f88877d7353e0_NeikiAnalytics.exe
-
Size
619KB
-
MD5
17888a2c90547f557c1f88877d7353e0
-
SHA1
582760951fd4418ec3f949ab5d55a53ce578203d
-
SHA256
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d
-
SHA512
cfe1ecc5b4e011e0f1281568519dbaf6b8b9bb73bd1a8d8fbc8547c2a846a24a2f7ccc273d182a086136c3689674fe74b1784717bcf094504e95fc4f4d67ca1d
-
SSDEEP
12288:iw2iN3skSKSIwpdj6kxlApT9NUYzKoXKMXPK6QD0GD7k0nVXB:iw19JSNIAdLL0WwhX8dvB
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-