General

  • Target

    199e79685a5f005185dd5e3cad841360_NeikiAnalytics.exe

  • Size

    4.3MB

  • Sample

    240610-rrbccayglh

  • MD5

    199e79685a5f005185dd5e3cad841360

  • SHA1

    649c565d9d526e4dc533ad6e89d58be82b7a3738

  • SHA256

    97cd2416b2a219d9818adebc61473358c4ee1829dbdea7963df56fc907f205ee

  • SHA512

    bb9f5765de73b34ae14dbf7702342309460cd12bfd1dabc011f3431f606b5899ea6be14f76ff10550857b4e427f4fa46456b926c13b8f1e9051b624745293fdb

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:7bBeSFkZ

Malware Config

Targets

    • Target

      199e79685a5f005185dd5e3cad841360_NeikiAnalytics.exe

    • Size

      4.3MB

    • MD5

      199e79685a5f005185dd5e3cad841360

    • SHA1

      649c565d9d526e4dc533ad6e89d58be82b7a3738

    • SHA256

      97cd2416b2a219d9818adebc61473358c4ee1829dbdea7963df56fc907f205ee

    • SHA512

      bb9f5765de73b34ae14dbf7702342309460cd12bfd1dabc011f3431f606b5899ea6be14f76ff10550857b4e427f4fa46456b926c13b8f1e9051b624745293fdb

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:7bBeSFkZ

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks