Overview

overview

9

Static

static

7

acb831cd00...cs.exe

windows7-x64

9

acb831cd00...cs.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acb831cd00533a74c21b1ce7ea6cc620_NeikiAnalytics.exe

  • Size

    80KB

  • Sample

    240523-xqldtacg39

  • MD5

    acb831cd00533a74c21b1ce7ea6cc620

  • SHA1

    40964b956d2cf96afe98b60bb5a57c7857627249

  • SHA256

    6fa9d0755da3dbe9d16344203c8484c0f13303b746e6e1c113370336e8c70951

  • SHA512

    3f2c8ac0116ed4235e6711d7821a0aaaff232c2f9f3eba1d61290d718cdf79d10a415c9e8aeb8a398d1669a73510a8cd1994f4a01476d96790226268567d6f95

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8kTWn1++PJHJXA/OsIZfzc3/Q8A:KQSonQSo3

Score
9/10
ransomwareupx

Malware Config

Targets

    • Target

      acb831cd00533a74c21b1ce7ea6cc620_NeikiAnalytics.exe

    • Size

      80KB

    • MD5

      acb831cd00533a74c21b1ce7ea6cc620

    • SHA1

      40964b956d2cf96afe98b60bb5a57c7857627249

    • SHA256

      6fa9d0755da3dbe9d16344203c8484c0f13303b746e6e1c113370336e8c70951

    • SHA512

      3f2c8ac0116ed4235e6711d7821a0aaaff232c2f9f3eba1d61290d718cdf79d10a415c9e8aeb8a398d1669a73510a8cd1994f4a01476d96790226268567d6f95

    • SSDEEP

      1536:CTWn1++PJHJXA/OsIZfzc3/Q8kTWn1++PJHJXA/OsIZfzc3/Q8A:KQSonQSo3

    Score
    9/10
    ransomwareupx

    • Renames multiple (4899) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks