ramnit | 772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.exe
Size 127KB
Sample240531-e4gnnsga86
SHA256 17a8cef3b5655f4fe6117629b7400f078506e02accc4705f1357cbac55f9522a
MD5 772283c17e80d7ebcfafefeedb261f40
SHA1 79a9064413616d6fa07c05ba8edd3d06e711900e
SHA512 f47a0698ccb784511c045a7dba49bb9534caceb9150ecd8083a80c9f8d85f1aa870fa3251dff17a80cba650c311c7e679cb386ce9a6c11d16793042b253a8d25
SSDEEP 3072:OMbIWiyr7pjvTUoBFEbWwIUJlTBft3+G+N:OCIWiyr7JTn16lTBl3+G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit

Malware Config

Signatures

Ramnit family
ramnit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.exe

File Explorer

772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.exe

.dll 127KB

772283c17e80d7ebcfafefeedb261f40_NeikiAnalytics.exe

IMPHASH 748f8e5a07c233ae071e8f9f57b0afba
SHA256 17a8cef3b5655f4fe6117629b7400f078506e02accc4705f1357cbac55f9522a
MD5 772283c17e80d7ebcfafefeedb261f40
SHA1 79a9064413616d6fa07c05ba8edd3d06e711900e
SHA512 f47a0698ccb784511c045a7dba49bb9534caceb9150ecd8083a80c9f8d85f1aa870fa3251dff17a80cba650c311c7e679cb386ce9a6c11d16793042b253a8d25
SSDEEP 3072:OMbIWiyr7pjvTUoBFEbWwIUJlTBft3+G+N:OCIWiyr7JTn16lTBl3+G
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError GetLocaleInfoA GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetProcAddress GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount GetVersionExA GetVolumeInformationA GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalReAlloc HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection GetFileTime LockFileEx MapViewOfFile MultiByteToWideChar OpenMutexA ReadFile ReleaseMutex SetEndOfFile SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep TryEnterCriticalSection UnlockFileEx UnmapViewOfFile WideCharToMultiByte WriteFile lstrcatA lstrcmpA lstrcmpiA lstrcpyA lstrcpynA lstrlenA lstrlenW GetFileSize GetFileAttributesA GetEnvironmentVariableA GetDriveTypeA GetDiskFreeSpaceExA GetCurrentProcess GetComputerNameA FindNextFileA FindFirstFileA ExpandEnvironmentStringsA FindClose ExitProcess EnterCriticalSection DeleteFileA DeleteCriticalSection CreateThread CreateProcessA CreateMutexA CreateFileMappingA CreateFileA CreateDirectoryA CopyFileA LoadLibraryA CloseHandle

ws2_32

getpeername gethostbyname connect closesocket bind getsockname __WSAFDIsSet WSAStartup WSAGetLastError WSACleanup socket send select htons inet_addr ioctlsocket listen accept recv

user32

GetWindowRect LoadCursorA MessageBoxA ReleaseDC GetWindowDC DrawTextA DrawIcon CharUpperBuffW wsprintfA GetIconInfo GetDesktopWindow ExitWindowsEx

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyExA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegSetValueExA GetUserNameA

shell32

ShellExecuteA

gdi32

CreateCompatibleDC DeleteDC DeleteObject GdiFlush SelectObject SetBkColor SetStretchBltMode SetTextColor StretchBlt CreateDIBSection

ole32

CreateStreamOnHGlobal

wininet

FindNextUrlCacheEntryA FindFirstUrlCacheGroup FindFirstUrlCacheEntryA FindCloseUrlCache DeleteUrlCacheGroup DeleteUrlCacheEntryA FindNextUrlCacheGroup