Overview

overview

10

Static

static

3

3b92fb864e...cs.exe

windows7-x64

10

3b92fb864e...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3b92fb864ef1b3b2a1eb77b056a9e830_NeikiAnalytics.exe

  • Size

    66KB

  • Sample

    240602-fpsytsce67

  • MD5

    3b92fb864ef1b3b2a1eb77b056a9e830

  • SHA1

    f6277118a0abb7e03fc2497d5cd529a14bc746c8

  • SHA256

    6055510740afbda663d615beac7ec8cd86403d36a6fcc964d32f608b0516bc33

  • SHA512

    9f0b93d2bc674425b7bf1f089c34562ee2fead11d959780ca0bd1e6fd8096fafcf20fc3700d4f26e28b3f508189ad66952bfa779a4654b8747d5d2f30a62b180

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiB:IeklMMYJhqezw/pXzH9iB

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      3b92fb864ef1b3b2a1eb77b056a9e830_NeikiAnalytics.exe

    • Size

      66KB

    • MD5

      3b92fb864ef1b3b2a1eb77b056a9e830

    • SHA1

      f6277118a0abb7e03fc2497d5cd529a14bc746c8

    • SHA256

      6055510740afbda663d615beac7ec8cd86403d36a6fcc964d32f608b0516bc33

    • SHA512

      9f0b93d2bc674425b7bf1f089c34562ee2fead11d959780ca0bd1e6fd8096fafcf20fc3700d4f26e28b3f508189ad66952bfa779a4654b8747d5d2f30a62b180

    • SSDEEP

      1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiB:IeklMMYJhqezw/pXzH9iB

    Score
    10/10
    evasionpersistencetrojan

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

      trojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks