Overview

overview

10

Static

static

3

0cee8ba7eb...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cee8ba7ebe22f9e45da5b130fd57210_NeikiAnalytics.exe

  • Size

    568KB

  • Sample

    240526-3mx64agc5s

  • MD5

    0cee8ba7ebe22f9e45da5b130fd57210

  • SHA1

    11351194dcd814daf82f5ea98cc362e715269998

  • SHA256

    2098d3a237e922ea2dabca27bb086df0422c045eaf30e605be9524cc2ceb8101

  • SHA512

    3097c35ab6a0228d94f602f4ee65ee2b30c8ec6e04e7b1ea7aa200eb8549d23e8ce2df6c938bf46be43a5d7daf58da908822c9ed8ab3f51a910a1d7e86e2a01d

  • SSDEEP

    12288:fy908ASadIwc0uwikZOTeP8FmhXmNQ8v5efKzMXwxmyRs:fyaRdIwBuxkPfXmifKqwxzs

Score
10/10
healerredlinedropperevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      0cee8ba7ebe22f9e45da5b130fd57210_NeikiAnalytics.exe

    • Size

      568KB

    • MD5

      0cee8ba7ebe22f9e45da5b130fd57210

    • SHA1

      11351194dcd814daf82f5ea98cc362e715269998

    • SHA256

      2098d3a237e922ea2dabca27bb086df0422c045eaf30e605be9524cc2ceb8101

    • SHA512

      3097c35ab6a0228d94f602f4ee65ee2b30c8ec6e04e7b1ea7aa200eb8549d23e8ce2df6c938bf46be43a5d7daf58da908822c9ed8ab3f51a910a1d7e86e2a01d

    • SSDEEP

      12288:fy908ASadIwc0uwikZOTeP8FmhXmNQ8v5efKzMXwxmyRs:fyaRdIwBuxkPfXmifKqwxzs

    Score
    10/10
    healerredlinedropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks