General

  • Target

    1e11a5ad6615d4671c9f9b5d824beb60_NeikiAnalytics.exe

  • Size

    65KB

  • Sample

    240604-b4qpsshf76

  • MD5

    1e11a5ad6615d4671c9f9b5d824beb60

  • SHA1

    045dd8b4460091088062205ed82b0e982f70cbff

  • SHA256

    af37ccb20fcb5d849b4f5a04eff82048f6dded2927c948cbb471372886364fb4

  • SHA512

    9612b43687368d97b3d27e9ae6c2c72b8bbeca33a136d8f1b199b60dad3edbf7536a7e303bf7542882bd7fcac57a671621277393457aa919db453c1743789398

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou4:7WNqkOJWmo1HpM0MkTUmu4

Malware Config

Targets

    • Target

      1e11a5ad6615d4671c9f9b5d824beb60_NeikiAnalytics.exe

    • Size

      65KB

    • MD5

      1e11a5ad6615d4671c9f9b5d824beb60

    • SHA1

      045dd8b4460091088062205ed82b0e982f70cbff

    • SHA256

      af37ccb20fcb5d849b4f5a04eff82048f6dded2927c948cbb471372886364fb4

    • SHA512

      9612b43687368d97b3d27e9ae6c2c72b8bbeca33a136d8f1b199b60dad3edbf7536a7e303bf7542882bd7fcac57a671621277393457aa919db453c1743789398

    • SSDEEP

      1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou4:7WNqkOJWmo1HpM0MkTUmu4

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks