General
-
Target
739c45be376b9d549cbfd71bad5c0080_NeikiAnalytics.exe
-
Size
51KB
-
Sample
240523-cglb8shg4z
-
MD5
739c45be376b9d549cbfd71bad5c0080
-
SHA1
488313db6bcc85ce64bfa68de365adc1c8cce621
-
SHA256
562e1c46eb4dd02176b086e90f3bc134643d1c490db7d5580859bd12d8c366f4
-
SHA512
e28b898afb8843156cd123c1e0481cdeadd99007dbc04db8d85d3d18569b228922471e1f08b2b4c3895372760d844e77bfc5fd0c72ec1e706272ff01d4cf87f7
-
SSDEEP
768:YxAxD/wT7p6hvnOCISM95oDbJn0syuj+ieXCOMVhoX6TrHni+oZlU:YImpenOd95ibJ0s73eSOUib0
Behavioral task
behavioral1
Sample
739c45be376b9d549cbfd71bad5c0080_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
739c45be376b9d549cbfd71bad5c0080_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
xworm
3.0
images-lauren.at.ply.gg:10544
-
Install_directory
%Userprofile%
-
install_file
Explorer.exe
Targets
-
-
Target
739c45be376b9d549cbfd71bad5c0080_NeikiAnalytics.exe
-
Size
51KB
-
MD5
739c45be376b9d549cbfd71bad5c0080
-
SHA1
488313db6bcc85ce64bfa68de365adc1c8cce621
-
SHA256
562e1c46eb4dd02176b086e90f3bc134643d1c490db7d5580859bd12d8c366f4
-
SHA512
e28b898afb8843156cd123c1e0481cdeadd99007dbc04db8d85d3d18569b228922471e1f08b2b4c3895372760d844e77bfc5fd0c72ec1e706272ff01d4cf87f7
-
SSDEEP
768:YxAxD/wT7p6hvnOCISM95oDbJn0syuj+ieXCOMVhoX6TrHni+oZlU:YImpenOd95ibJ0s73eSOUib0
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-