General

  • Target

    2bc6fb9cb93f270d5ee0ee1385a310f0_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240612-kfdvrswcrl

  • MD5

    2bc6fb9cb93f270d5ee0ee1385a310f0

  • SHA1

    eb716ad9018bea244932bf437ab0c71f361dc746

  • SHA256

    56d251ad626228cff6df3205e20f5c5f9ee506f505a3e7f488d99a5bb718b75a

  • SHA512

    a9e835ed8241b871a57a37d0b8dc8a09bd480df298dccd0c0a1d5c615bab1cfbd2d60297ea6d3c67f4cb62a8849aea3687f964b7b8ee9784a66f8fdd3c42a4aa

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD

Malware Config

Targets

    • Target

      2bc6fb9cb93f270d5ee0ee1385a310f0_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      2bc6fb9cb93f270d5ee0ee1385a310f0

    • SHA1

      eb716ad9018bea244932bf437ab0c71f361dc746

    • SHA256

      56d251ad626228cff6df3205e20f5c5f9ee506f505a3e7f488d99a5bb718b75a

    • SHA512

      a9e835ed8241b871a57a37d0b8dc8a09bd480df298dccd0c0a1d5c615bab1cfbd2d60297ea6d3c67f4cb62a8849aea3687f964b7b8ee9784a66f8fdd3c42a4aa

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks