Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    44670e54f646a7512df3cc90b3bb6d20_NeikiAnalytics.exe

  • Size

    796KB

  • Sample

    240604-kd1xhsbd38

  • MD5

    44670e54f646a7512df3cc90b3bb6d20

  • SHA1

    d546b95b956e4a8704500d981aa5f85b924aac81

  • SHA256

    09f150e7562aad51bb6d42be96b3473afeebf2f0ed086636f7fde55bdcd2ac1f

  • SHA512

    5f53ed3cbce9f0f1d0ad2e2e38250f12f3d135e9ab6fe361898b13c5661d272a088a33c45ac5fee88f84da5c026fc79a597785be1c9c1f4e1adb68cc72a7bbcc

  • SSDEEP

    12288:VEQoSfq+d2etObhM3UKpjabtbA3RSwvXsJWIQrpasOs00k+hvnvfcWvJe:VketSMEKpjabt4jvXUW7740dvfM

Malware Config

Targets

    • Target

      44670e54f646a7512df3cc90b3bb6d20_NeikiAnalytics.exe

    • Size

      796KB

    • MD5

      44670e54f646a7512df3cc90b3bb6d20

    • SHA1

      d546b95b956e4a8704500d981aa5f85b924aac81

    • SHA256

      09f150e7562aad51bb6d42be96b3473afeebf2f0ed086636f7fde55bdcd2ac1f

    • SHA512

      5f53ed3cbce9f0f1d0ad2e2e38250f12f3d135e9ab6fe361898b13c5661d272a088a33c45ac5fee88f84da5c026fc79a597785be1c9c1f4e1adb68cc72a7bbcc

    • SSDEEP

      12288:VEQoSfq+d2etObhM3UKpjabtbA3RSwvXsJWIQrpasOs00k+hvnvfcWvJe:VketSMEKpjabt4jvXUW7740dvfM

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks