Extracted

• • Target

    7a2ba3a0ea63a05df8fba51f9359d220_NeikiAnalytics.exe

  • Size

    6.9MB

  • MD5

    7a2ba3a0ea63a05df8fba51f9359d220

  • SHA1

    6163d17d53cbbe1ae1d52e07e5d33f767273c425

  • SHA256

    b9dc7fec20c8f8a571a8effefdd00adf90a6d7e57dd0abc169413511f7398891

  • SHA512

    9b60cd0a23e726d44ef5560d3df27256a142f110ec4902eac72faa203536ab7e125979f40ce53ef8dc69a75d55980ebe62d3b5a9789657d2c0b8347bcb85b80e

  • SSDEEP

    196608:crAU06peNTfm/pf+xk4dWRGtrbWOjgWyB:uay/pWu4kRGtrbvMWyB

  Score

  10^/10

  upxexecutionspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2