General

  • Target

    52908dd81b84e018038de3b1f50d2cd0_NeikiAnalytics.exe

  • Size

    3.2MB

  • Sample

    240525-p63c9sdc92

  • MD5

    52908dd81b84e018038de3b1f50d2cd0

  • SHA1

    6efa846142886fe4a1c258120747129290ddf21c

  • SHA256

    0d1c443bbde0478ee06303381ce86d626a5135d1e1b2022bb5afa1696ef236f8

  • SHA512

    1b09ae9816865a0c1de91198792632540e86d7acec497f1b02394ff8ce192a3c0fc69952d45e3367a5526ca941312fd43e6eecb9fc86d87228c1598084f5b3d2

  • SSDEEP

    98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:SbBeSFks

Malware Config

Targets

    • Target

      52908dd81b84e018038de3b1f50d2cd0_NeikiAnalytics.exe

    • Size

      3.2MB

    • MD5

      52908dd81b84e018038de3b1f50d2cd0

    • SHA1

      6efa846142886fe4a1c258120747129290ddf21c

    • SHA256

      0d1c443bbde0478ee06303381ce86d626a5135d1e1b2022bb5afa1696ef236f8

    • SHA512

      1b09ae9816865a0c1de91198792632540e86d7acec497f1b02394ff8ce192a3c0fc69952d45e3367a5526ca941312fd43e6eecb9fc86d87228c1598084f5b3d2

    • SSDEEP

      98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:SbBeSFks

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks