General
-
Target
5b00304752992d19c78548d990e6ba20_NeikiAnalytics.exe
-
Size
308KB
-
Sample
240529-3ra75aed7z
-
MD5
5b00304752992d19c78548d990e6ba20
-
SHA1
60ef7e3044129fecc059f3e150467e5f8a0a16af
-
SHA256
d167484a95df7ee2846d4cb2446b7b99ce63dd9841e5a6e23d2ec980f010a6b3
-
SHA512
4b02c5048dece98cf1d467454c95569564853fd1c5a24df6af61bb9b7e72b0c1b4fdf5ca4cf01310442e50d10473285e998701ed44ed29261c4bcd5e82d1e031
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Static task
static1
Behavioral task
behavioral1
Sample
5b00304752992d19c78548d990e6ba20_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5b00304752992d19c78548d990e6ba20_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
5b00304752992d19c78548d990e6ba20_NeikiAnalytics.exe
-
Size
308KB
-
MD5
5b00304752992d19c78548d990e6ba20
-
SHA1
60ef7e3044129fecc059f3e150467e5f8a0a16af
-
SHA256
d167484a95df7ee2846d4cb2446b7b99ce63dd9841e5a6e23d2ec980f010a6b3
-
SHA512
4b02c5048dece98cf1d467454c95569564853fd1c5a24df6af61bb9b7e72b0c1b4fdf5ca4cf01310442e50d10473285e998701ed44ed29261c4bcd5e82d1e031
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-