General

  • Target

    b2b8b92259083d41a32bfc71f5da5640_NeikiAnalytics.exe

  • Size

    7.1MB

  • Sample

    240524-zrrnbsah2w

  • MD5

    b2b8b92259083d41a32bfc71f5da5640

  • SHA1

    4c0481c11a962d39c51bf04923f7ab7ccd1bf62a

  • SHA256

    a6064ab26619eeb468ff0c4155ebb12dae6281733a4411b9a1851f8067930492

  • SHA512

    0de19531426470b4606f9d6b80fe32f30082abeeec846ddb0741a6f07d2afb696ceec11f14182778bafce1af4f2f6565a7939295ea4a8e44d72ef4ec9f0192b7

  • SSDEEP

    196608:pWoXymgHcC4NmQvjx4a0FA26Vd/cI279tPjqb7Qd:pWoXymgpwjm226o79tf

Score
7/10

Malware Config

Targets

    • Target

      b2b8b92259083d41a32bfc71f5da5640_NeikiAnalytics.exe

    • Size

      7.1MB

    • MD5

      b2b8b92259083d41a32bfc71f5da5640

    • SHA1

      4c0481c11a962d39c51bf04923f7ab7ccd1bf62a

    • SHA256

      a6064ab26619eeb468ff0c4155ebb12dae6281733a4411b9a1851f8067930492

    • SHA512

      0de19531426470b4606f9d6b80fe32f30082abeeec846ddb0741a6f07d2afb696ceec11f14182778bafce1af4f2f6565a7939295ea4a8e44d72ef4ec9f0192b7

    • SSDEEP

      196608:pWoXymgHcC4NmQvjx4a0FA26Vd/cI279tPjqb7Qd:pWoXymgpwjm226o79tf

    Score
    7/10
    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks