Overview

overview

10

Static

static

3

eb64873d87...cs.exe

windows7-x64

10

eb64873d87...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    eb64873d877969358cb324f6fc35bea0_NeikiAnalytics.exe

  • Size

    66KB

  • Sample

    240525-bj662she59

  • MD5

    eb64873d877969358cb324f6fc35bea0

  • SHA1

    e53ab8e99b0a097f7c473a9c542eb5dcbae315bb

  • SHA256

    9ee06eb562f51b3ca0b44d019a25339363f5f07df8ac99eee70145cba8eda904

  • SHA512

    fa9968d50e2d50d6cd096c3fc631b975acad5153142f26ad89b77dd72472c41aef717ff627075d334263d1492000085201f5836b9052333a06a9acc45799d94c

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiaNNNNNNNNNNNNNNNNNNNNX:IeklMMYJhqezw/pXzH9iaNNNNNNNNNNX

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      eb64873d877969358cb324f6fc35bea0_NeikiAnalytics.exe

    • Size

      66KB

    • MD5

      eb64873d877969358cb324f6fc35bea0

    • SHA1

      e53ab8e99b0a097f7c473a9c542eb5dcbae315bb

    • SHA256

      9ee06eb562f51b3ca0b44d019a25339363f5f07df8ac99eee70145cba8eda904

    • SHA512

      fa9968d50e2d50d6cd096c3fc631b975acad5153142f26ad89b77dd72472c41aef717ff627075d334263d1492000085201f5836b9052333a06a9acc45799d94c

    • SSDEEP

      1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiaNNNNNNNNNNNNNNNNNNNNX:IeklMMYJhqezw/pXzH9iaNNNNNNNNNNX

    Score
    10/10
    evasionpersistencetrojan

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

      trojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks