Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9d5bfb9a909166a404187e5a8c5e9cea6460489892e5207e429f125b643778a0_NeikiAnalytics.exe

  • Size

    2.8MB

  • Sample

    240628-sbev9svdqe

  • MD5

    4626bf1bb41ffb14fc2148eeaffafe30

  • SHA1

    3baf6303dd43311e7ed8efa3a42d0a1f05cd0221

  • SHA256

    9d5bfb9a909166a404187e5a8c5e9cea6460489892e5207e429f125b643778a0

  • SHA512

    6f6f18fb636dae0255384159b25cb0e67d7af011377c56bbbdb4eef90ac945a6c554aa06f03cc17e5a0375db045a6dec202aba7d7aa6aa9201707e07755f4ba6

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkiqtI+ijR25K+V3:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS

Malware Config

Targets

    • Target

      9d5bfb9a909166a404187e5a8c5e9cea6460489892e5207e429f125b643778a0_NeikiAnalytics.exe

    • Size

      2.8MB

    • MD5

      4626bf1bb41ffb14fc2148eeaffafe30

    • SHA1

      3baf6303dd43311e7ed8efa3a42d0a1f05cd0221

    • SHA256

      9d5bfb9a909166a404187e5a8c5e9cea6460489892e5207e429f125b643778a0

    • SHA512

      6f6f18fb636dae0255384159b25cb0e67d7af011377c56bbbdb4eef90ac945a6c554aa06f03cc17e5a0375db045a6dec202aba7d7aa6aa9201707e07755f4ba6

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkiqtI+ijR25K+V3:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks