Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    183f63c31ab8eb5f96966cdd82458e70_NeikiAnalytics.exe

  • Size

    2.6MB

  • Sample

    240526-v1zyvaeg92

  • MD5

    183f63c31ab8eb5f96966cdd82458e70

  • SHA1

    2312ced531865c3d0f62216d02d60a0a02cb9395

  • SHA256

    1b7c819b26747ab76044ac13a4c7f5dfe14eb0b867a0663866efe134152b26e7

  • SHA512

    9c091ab548ffc451db8185f03b5a60a4a470636b7b81e672c2333ffe10df0079508751c4c70e1cebeae77e1c71521862d27531c5183bca2f9d62ad1358e3e9c1

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2N:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT

Malware Config

Targets

    • Target

      183f63c31ab8eb5f96966cdd82458e70_NeikiAnalytics.exe

    • Size

      2.6MB

    • MD5

      183f63c31ab8eb5f96966cdd82458e70

    • SHA1

      2312ced531865c3d0f62216d02d60a0a02cb9395

    • SHA256

      1b7c819b26747ab76044ac13a4c7f5dfe14eb0b867a0663866efe134152b26e7

    • SHA512

      9c091ab548ffc451db8185f03b5a60a4a470636b7b81e672c2333ffe10df0079508751c4c70e1cebeae77e1c71521862d27531c5183bca2f9d62ad1358e3e9c1

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2N:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks