General

  • Target

    47a853bac59753e86095eb6674799520_NeikiAnalytics.exe

  • Size

    1.6MB

  • Sample

    240522-1zvkmaag43

  • MD5

    47a853bac59753e86095eb6674799520

  • SHA1

    b7d5964447a901f79c36bedeef870c8678be3417

  • SHA256

    a0dcb3c28b876159e03238bbc8fef64a87139be7eb6e60fdbf046105452f9a28

  • SHA512

    32b33b0f38d712ff12f2e7ab8e14f17cb684065eeac2e2a6de8954b7561a9a1fe01fd651133b6859b6b7115be27ce377e136d71d4449bca52b5b9386f4c67339

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbl:Lz071uv4BPMkHC0I6Gz3N1pHP7F

Malware Config

Targets

    • Target

      47a853bac59753e86095eb6674799520_NeikiAnalytics.exe

    • Size

      1.6MB

    • MD5

      47a853bac59753e86095eb6674799520

    • SHA1

      b7d5964447a901f79c36bedeef870c8678be3417

    • SHA256

      a0dcb3c28b876159e03238bbc8fef64a87139be7eb6e60fdbf046105452f9a28

    • SHA512

      32b33b0f38d712ff12f2e7ab8e14f17cb684065eeac2e2a6de8954b7561a9a1fe01fd651133b6859b6b7115be27ce377e136d71d4449bca52b5b9386f4c67339

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbl:Lz071uv4BPMkHC0I6Gz3N1pHP7F

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks