General

  • Target

    ac6a3300cfb14872bbb7da9fb8256a30_NeikiAnalytics.exe

  • Size

    3.2MB

  • Sample

    240614-h55zfatdnm

  • MD5

    ac6a3300cfb14872bbb7da9fb8256a30

  • SHA1

    3642ce10be44351c36cfb98e456ba371767b2fe2

  • SHA256

    8e32bea5751882c35e22f248974811dbb49aa367150a96b2a69337bb756ea49e

  • SHA512

    98072fc3b02ff59daf4402934846a70d1c5ced76e2938cdcc1674772bebf0cc80f3b7fe417d9efa608be38c1e156cd8743297245ed277fd84df9c80fc0ba7628

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:7bBeSFkC

Malware Config

Targets

    • Target

      ac6a3300cfb14872bbb7da9fb8256a30_NeikiAnalytics.exe

    • Size

      3.2MB

    • MD5

      ac6a3300cfb14872bbb7da9fb8256a30

    • SHA1

      3642ce10be44351c36cfb98e456ba371767b2fe2

    • SHA256

      8e32bea5751882c35e22f248974811dbb49aa367150a96b2a69337bb756ea49e

    • SHA512

      98072fc3b02ff59daf4402934846a70d1c5ced76e2938cdcc1674772bebf0cc80f3b7fe417d9efa608be38c1e156cd8743297245ed277fd84df9c80fc0ba7628

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:7bBeSFkC

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks