General
-
Target
9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe
-
Size
1.4MB
-
Sample
240525-aggb6sfg81
-
MD5
9905d7462bc9624d11151947fc753ce0
-
SHA1
a57832fdc1e899ce1c093e6733468710132be391
-
SHA256
857a856cb1b2698b79839b1fd446178d19b179fffeb8e33ab150495ca87492a1
-
SHA512
0dc21a8ccb49beace8885a16c289c2aafaed0599354a804f9a9031d0068b2209369ff9ee66a831ad9d28e9ead42c789b7c47385860d1454a9c8712fc8e28a199
-
SSDEEP
24576:yn25nPkW3amy8sQxeWcktTjbJ47auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbO/DyEEEEEEEEEEEEEEEEm
Static task
static1
Behavioral task
behavioral1
Sample
9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
remcos
ADAMA
embargogo237.duckdns.org:10521
embargogo2378.duckdns.org:10522
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
iexplorez
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
ppmz-4TIB8J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
9905d7462bc9624d11151947fc753ce0
-
SHA1
a57832fdc1e899ce1c093e6733468710132be391
-
SHA256
857a856cb1b2698b79839b1fd446178d19b179fffeb8e33ab150495ca87492a1
-
SHA512
0dc21a8ccb49beace8885a16c289c2aafaed0599354a804f9a9031d0068b2209369ff9ee66a831ad9d28e9ead42c789b7c47385860d1454a9c8712fc8e28a199
-
SSDEEP
24576:yn25nPkW3amy8sQxeWcktTjbJ47auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbO/DyEEEEEEEEEEEEEEEEm
Score10/10-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-