General

  • Target

    272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96_NeikiAnalytics

  • Size

    3KB

  • Sample

    240521-kya7lafe28

  • MD5

    5cbd62c9056010b9be5c0dd7e1b06247

  • SHA1

    f75727539f2d3efa6c58101f1f5258905776c68f

  • SHA256

    272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96

  • SHA512

    e83ff1f4aa78bd0dfd1806881b4ef1559dc7198ff8af78828121779e9324b0a46463d32649d23cfbb72b66b0dbe775fb4e1b756e1184077ed737a3f62c4519a7

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

170.187.138.149:48887

Targets

    • Target

      272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96_NeikiAnalytics

    • Size

      3KB

    • MD5

      5cbd62c9056010b9be5c0dd7e1b06247

    • SHA1

      f75727539f2d3efa6c58101f1f5258905776c68f

    • SHA256

      272d3bc9dc21492428bd30b3e850d1c4fd7f76a6df121a6f14c0e5f1a4b95e96

    • SHA512

      e83ff1f4aa78bd0dfd1806881b4ef1559dc7198ff8af78828121779e9324b0a46463d32649d23cfbb72b66b0dbe775fb4e1b756e1184077ed737a3f62c4519a7

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks