General
-
Target
93ce2f1033f7d26a12bdb0ae8f721d80_NeikiAnalytics.exe
-
Size
1.7MB
-
Sample
240523-j5g32sae3w
-
MD5
93ce2f1033f7d26a12bdb0ae8f721d80
-
SHA1
c8aada969ad142a99e696416263e6fd4c28d3b58
-
SHA256
1ba832d06573b1784c09a0b65f23bf348d0beb4efe415053d23f58d687056481
-
SHA512
c420ec6f6be3226dc8bc4718c088c47be77de348ae1308049244f35ef8ff3aa96c7e0656ab6c5559d20c50ee8b4c861429b694a780ec6205f8b8edf5b5d8a5d9
-
SSDEEP
24576:QKmeWJMjRaVdFtAK59foIK5w/6clN9+PzVyo6NxnfAPEZKLooMe1N3QnlRNlOdcv:oZJeRm3zfUUlNAPzVlY5AMaoAL3Yv
Behavioral task
behavioral1
Sample
93ce2f1033f7d26a12bdb0ae8f721d80_NeikiAnalytics.exe
Resource
win7-20231129-en
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Targets
-
-
Target
93ce2f1033f7d26a12bdb0ae8f721d80_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
93ce2f1033f7d26a12bdb0ae8f721d80
-
SHA1
c8aada969ad142a99e696416263e6fd4c28d3b58
-
SHA256
1ba832d06573b1784c09a0b65f23bf348d0beb4efe415053d23f58d687056481
-
SHA512
c420ec6f6be3226dc8bc4718c088c47be77de348ae1308049244f35ef8ff3aa96c7e0656ab6c5559d20c50ee8b4c861429b694a780ec6205f8b8edf5b5d8a5d9
-
SSDEEP
24576:QKmeWJMjRaVdFtAK59foIK5w/6clN9+PzVyo6NxnfAPEZKLooMe1N3QnlRNlOdcv:oZJeRm3zfUUlNAPzVlY5AMaoAL3Yv
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-