General

  • Target

    88a9e217917a243912d496080c522ad0_NeikiAnalytics.exe

  • Size

    2.8MB

  • Sample

    240525-rxzl5afh6t

  • MD5

    88a9e217917a243912d496080c522ad0

  • SHA1

    39a5f558445c7cb324a46bb9ce646008a35175c6

  • SHA256

    b8550e9e10c54f7760010688c426abbaf224808ca3debc9a385cf977e72f563a

  • SHA512

    d9e82ad0541c54eda64a050da9e063d346fc222060395e68a5a746bf95e0c9726c6e6537ca13f5d655c2cc2f6bdf170af055376c03f2551a0d1b633b694e43fb

  • SSDEEP

    49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hjGhql0lQGQBC38yw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI

Malware Config

Targets

    • Target

      88a9e217917a243912d496080c522ad0_NeikiAnalytics.exe

    • Size

      2.8MB

    • MD5

      88a9e217917a243912d496080c522ad0

    • SHA1

      39a5f558445c7cb324a46bb9ce646008a35175c6

    • SHA256

      b8550e9e10c54f7760010688c426abbaf224808ca3debc9a385cf977e72f563a

    • SHA512

      d9e82ad0541c54eda64a050da9e063d346fc222060395e68a5a746bf95e0c9726c6e6537ca13f5d655c2cc2f6bdf170af055376c03f2551a0d1b633b694e43fb

    • SSDEEP

      49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hjGhql0lQGQBC38yw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks