Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe

  • Size

    3.3MB

  • Sample

    240625-sy44ns1dqk

  • MD5

    41c0c3b14b92b3dec290853c80aebd60

  • SHA1

    8668ee14d212cd24daa454dee7e2d90c6b53cf86

  • SHA256

    71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d

  • SHA512

    29e6aaa5d76b6c622e65d6faac6d7bd5dde013bdc8e33d5b200902b0fe47e3ffe7ab734ada9b393752e0acfe90fd75b9526a9d093e88c5dddd62aad1c8e6d7c1

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFk9

Malware Config

Targets

    • Target

      71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe

    • Size

      3.3MB

    • MD5

      41c0c3b14b92b3dec290853c80aebd60

    • SHA1

      8668ee14d212cd24daa454dee7e2d90c6b53cf86

    • SHA256

      71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d

    • SHA512

      29e6aaa5d76b6c622e65d6faac6d7bd5dde013bdc8e33d5b200902b0fe47e3ffe7ab734ada9b393752e0acfe90fd75b9526a9d093e88c5dddd62aad1c8e6d7c1

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFk9

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks