Overview

overview

10

Static

static

3

0e151bf158...cs.exe

windows7-x64

10

0e151bf158...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e151bf158cee4eb0de5c8dc297b09a0_NeikiAnalytics.exe

  • Size

    875KB

  • Sample

    240611-3s4wtswdmg

  • MD5

    0e151bf158cee4eb0de5c8dc297b09a0

  • SHA1

    382d97c653365402dc7b88703f01c22950a5e37f

  • SHA256

    9b5362142a7a4cbb8fdd1f2d947ebedbde5289f245e3777601ff964672a1d700

  • SHA512

    0e41168f3c4d757ac67ee4d03460d4b710d86115c04d9b04a8eb9550d17d52f8cc7fbeb91d29b8353ee594c545e8cc1542cf3804579751a2cc696d7b64da12df

  • SSDEEP

    12288:GQWN/7YkrWBfWhvRhQUAIUfezD/LoN/MhVl1cJ6Q5joTeRH6R:GQWN/7DSBfWhA030Nc1ujo616

Score
10/10
expirobackdoordiscoveryevasionspywarestealertrojan

Malware Config

Targets

    • Target

      0e151bf158cee4eb0de5c8dc297b09a0_NeikiAnalytics.exe

    • Size

      875KB

    • MD5

      0e151bf158cee4eb0de5c8dc297b09a0

    • SHA1

      382d97c653365402dc7b88703f01c22950a5e37f

    • SHA256

      9b5362142a7a4cbb8fdd1f2d947ebedbde5289f245e3777601ff964672a1d700

    • SHA512

      0e41168f3c4d757ac67ee4d03460d4b710d86115c04d9b04a8eb9550d17d52f8cc7fbeb91d29b8353ee594c545e8cc1542cf3804579751a2cc696d7b64da12df

    • SSDEEP

      12288:GQWN/7YkrWBfWhvRhQUAIUfezD/LoN/MhVl1cJ6Q5joTeRH6R:GQWN/7DSBfWhA030Nc1ujo616

    Score
    10/10
    expirobackdoordiscoveryevasionspywarestealertrojan

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks