metasploit | 108156bb8ee3cbe08325bc921e52baa0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
108156bb8ee3cbe08325bc921e52baa0_NeikiAnalytics.exe
Size 79KB
Sample240521-2gkhdace2t
SHA256 cb1b83886f1e0b246be964a442cb1c2587c8c7023c4349af57ce85610ea67c72
MD5 108156bb8ee3cbe08325bc921e52baa0
SHA1 c4875a85eb224f4dd84b3680a075228028450efd
SHA512 f9097c3d41ba62bad398c1f5d9641e0b83ebabe66ca997a7b0b5f14227749524480266bfbef38f7d9afb5b762970f43264cfe1935b3444f5ad4bf0b73aa2c1a7
SSDEEP 768:RnudCPfT7sG/Po0yEV8yDAqiYqSVVrBBnEAY9C:RnOCHTw6QgV8nqNVVrBBE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

192.168.254.23:443

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
108156bb8ee3cbe08325bc921e52baa0_NeikiAnalytics.exe

File Explorer

108156bb8ee3cbe08325bc921e52baa0_NeikiAnalytics.exe

.exe 79KB

108156bb8ee3cbe08325bc921e52baa0_NeikiAnalytics.exe

IMPHASH 6ca159b610f80f850412854333df476f
SHA256 cb1b83886f1e0b246be964a442cb1c2587c8c7023c4349af57ce85610ea67c72
MD5 108156bb8ee3cbe08325bc921e52baa0
SHA1 c4875a85eb224f4dd84b3680a075228028450efd
SHA512 f9097c3d41ba62bad398c1f5d9641e0b83ebabe66ca997a7b0b5f14227749524480266bfbef38f7d9afb5b762970f43264cfe1935b3444f5ad4bf0b73aa2c1a7
SSDEEP 768:RnudCPfT7sG/Po0yEV8yDAqiYqSVVrBBnEAY9C:RnOCHTw6QgV8nqNVVrBBE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70522

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Projects\SECRETMAL\x64\Debug\SECRETMAL.pdb

kernel32

OpenProcess CloseHandle WaitForSingleObject CreateRemoteThreadEx VirtualAllocEx WriteProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry GetProcAddress RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetCurrentThreadId FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW

msvcp140d

_Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join

vcruntime140_1d

__CxxFrameHandler4

vcruntime140d

_CxxThrowException __std_exception_destroy __std_type_info_destroy_list __C_specific_handler __C_specific_handler_noexcept __current_exception __current_exception_context memcpy __vcrt_GetModuleFileNameW __std_exception_copy __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW

ucrtbased

strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _wmakepath_s _wsplitpath_s wcscpy_s _free_dbg _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit _cexit __p__commode _set_fmode _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport malloc _callnewh wcscmp _beginthreadex terminate __p___argc _set_new_mode __p___argv

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

730B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

763B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

108156bb8ee3cbe08325bc921e52baa0_NeikiAnalytics.exe

kernel32

msvcp140d

vcruntime140_1d

vcruntime140d

ucrtbased

generic