General

  • Target

    10bd6b886282a9f9da1cfa2463c16740_NeikiAnalytics.exe

  • Size

    65KB

  • Sample

    240603-3d1kvsdg38

  • MD5

    10bd6b886282a9f9da1cfa2463c16740

  • SHA1

    ea4ee727bcfd334f10d735aa3fc493b533a4ae41

  • SHA256

    a36f7d7dad3e34719de19291f30d353b7a7306ccd49fef5a99a054657ad8436b

  • SHA512

    263dd56ee453e1c005c54dbbf822b30b0b4035715638eb8aebfe2d092e5871d13bf263b4436cd593f89277278ce61d03a4ad7713ad5ea13975d4e0733529e0ee

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou0:7WNqkOJWmo1HpM0MkTUmu0

Malware Config

Targets

    • Target

      10bd6b886282a9f9da1cfa2463c16740_NeikiAnalytics.exe

    • Size

      65KB

    • MD5

      10bd6b886282a9f9da1cfa2463c16740

    • SHA1

      ea4ee727bcfd334f10d735aa3fc493b533a4ae41

    • SHA256

      a36f7d7dad3e34719de19291f30d353b7a7306ccd49fef5a99a054657ad8436b

    • SHA512

      263dd56ee453e1c005c54dbbf822b30b0b4035715638eb8aebfe2d092e5871d13bf263b4436cd593f89277278ce61d03a4ad7713ad5ea13975d4e0733529e0ee

    • SSDEEP

      1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou0:7WNqkOJWmo1HpM0MkTUmu0

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks