General

  • Target

    0f1e34215307d0164b426415d9620f80_NeikiAnalytics.exe

  • Size

    1.6MB

  • Sample

    240527-xsskxaed9w

  • MD5

    0f1e34215307d0164b426415d9620f80

  • SHA1

    66d3a038bade558c4e7fffa0cb6c819343a81042

  • SHA256

    316e818039c9d71204ee2c724da7294c19c1da5bb80482f3bddf3e4bb1289154

  • SHA512

    3168af9037b081b1f6a2d2782bb4e05beddf14c67bd0c394cd75c1e534f23655f3cdefe7451a55ec135aab3fd9e2e13451ebe0df24aec6b93d6e2ee5238170ee

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5e0ag2K0hvL7n:Lz071uv4BPMkyW10/wKV7hjSe05c2e

Malware Config

Targets

    • Target

      0f1e34215307d0164b426415d9620f80_NeikiAnalytics.exe

    • Size

      1.6MB

    • MD5

      0f1e34215307d0164b426415d9620f80

    • SHA1

      66d3a038bade558c4e7fffa0cb6c819343a81042

    • SHA256

      316e818039c9d71204ee2c724da7294c19c1da5bb80482f3bddf3e4bb1289154

    • SHA512

      3168af9037b081b1f6a2d2782bb4e05beddf14c67bd0c394cd75c1e534f23655f3cdefe7451a55ec135aab3fd9e2e13451ebe0df24aec6b93d6e2ee5238170ee

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5e0ag2K0hvL7n:Lz071uv4BPMkyW10/wKV7hjSe05c2e

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks