Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e_NeikiAnalytics.exe
-
Size
2.3MB
-
Sample
240628-rex1kstcpa
-
MD5
bc1626d0ce3ec13f3a762c85de00c160
-
SHA1
5e1abeffc1f1d1ec718653f75f285969cef24ff0
-
SHA256
9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e
-
SHA512
8c9c53a3efdca297e86d1f538b6c53900a7d9b08be5bf29de2951b0796c6ff580f13d3710be8339e20ed62f68aa2b65032ebbb612b37c6464f01113fb3478bc5
-
SSDEEP
49152:2z/Bn1n4A8go9YmqGZjmahahF38QkesaXikiaSMX9sbk:2zF17zgNmrBlk6Xi+VsA
Static task
static1
Behavioral task
behavioral1
Sample
9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e_NeikiAnalytics.exe
Resource
win7-20240220-en
Malware Config
Extracted
risepro
77.91.77.66:58709
Targets
-
-
Target
9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e_NeikiAnalytics.exe
-
Size
2.3MB
-
MD5
bc1626d0ce3ec13f3a762c85de00c160
-
SHA1
5e1abeffc1f1d1ec718653f75f285969cef24ff0
-
SHA256
9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e
-
SHA512
8c9c53a3efdca297e86d1f538b6c53900a7d9b08be5bf29de2951b0796c6ff580f13d3710be8339e20ed62f68aa2b65032ebbb612b37c6464f01113fb3478bc5
-
SSDEEP
49152:2z/Bn1n4A8go9YmqGZjmahahF38QkesaXikiaSMX9sbk:2zF17zgNmrBlk6Xi+VsA
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-