Overview

overview

10

Static

static

3

37fb2a09a4...cs.exe

windows7-x64

10

37fb2a09a4...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37fb2a09a4a643cace8f4676cc838a70_NeikiAnalytics.exe

  • Size

    65KB

  • Sample

    240522-zk8chagb56

  • MD5

    37fb2a09a4a643cace8f4676cc838a70

  • SHA1

    1682e4be6bd40d1eca2c36bdf65bef8400fdd01d

  • SHA256

    725170bf2391fec3b2c4e9140fe18e0ec462f5e3233d047412ec61f9217eba32

  • SHA512

    aefa22382c2cf095b2f00429f4939cbc663608abcefe628de800f6ccdb4e452f165c3bd1990a26c01e54c40edd049d14c97f914638ba67e30fc55a57f4be64a9

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuH:7WNqkOJWmo1HpM0MkTUmuH

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      37fb2a09a4a643cace8f4676cc838a70_NeikiAnalytics.exe

    • Size

      65KB

    • MD5

      37fb2a09a4a643cace8f4676cc838a70

    • SHA1

      1682e4be6bd40d1eca2c36bdf65bef8400fdd01d

    • SHA256

      725170bf2391fec3b2c4e9140fe18e0ec462f5e3233d047412ec61f9217eba32

    • SHA512

      aefa22382c2cf095b2f00429f4939cbc663608abcefe628de800f6ccdb4e452f165c3bd1990a26c01e54c40edd049d14c97f914638ba67e30fc55a57f4be64a9

    • SSDEEP

      1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuH:7WNqkOJWmo1HpM0MkTUmuH

    Score
    10/10
    evasionpersistencetrojan

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

      trojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks