General

  • Target

    08fb985e4651db251672deb148e808b0_NeikiAnalytics.exe

  • Size

    1.6MB

  • Sample

    240525-w88fmadg3s

  • MD5

    08fb985e4651db251672deb148e808b0

  • SHA1

    a66272b434b4bbaec9eee1c18566b2ed6ddff28f

  • SHA256

    272aa18afd5e59c0b26926e254e76dcfe83d53d54b5e3e0fd695858188731e75

  • SHA512

    4fb97952b391cfdf401e4f07bd2c17dfcad740f9d607d0b4f58cc53a2c8445acdf30b3bb77e589c6caa59708fc9739d2de9334454f19a0a2d2cf9ceb852d4490

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/p1EB:Lz071uv4BPMkFfdk2auTqao/c/pG

Malware Config

Targets

    • Target

      08fb985e4651db251672deb148e808b0_NeikiAnalytics.exe

    • Size

      1.6MB

    • MD5

      08fb985e4651db251672deb148e808b0

    • SHA1

      a66272b434b4bbaec9eee1c18566b2ed6ddff28f

    • SHA256

      272aa18afd5e59c0b26926e254e76dcfe83d53d54b5e3e0fd695858188731e75

    • SHA512

      4fb97952b391cfdf401e4f07bd2c17dfcad740f9d607d0b4f58cc53a2c8445acdf30b3bb77e589c6caa59708fc9739d2de9334454f19a0a2d2cf9ceb852d4490

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/p1EB:Lz071uv4BPMkFfdk2auTqao/c/pG

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks