Overview

overview

7

Static

static

3

0fb02e96a5...cs.exe

windows7-x64

7

0fb02e96a5...cs.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    0fb02e96a51d855b8399f2bbde7f3cd8be95f5f0c32a81a37a729f0a7c4b0fee_NeikiAnalytics.exe

  • Size

    1.0MB

  • Sample

    240629-3ytytazcpd

  • MD5

    23017d22578e187125c0ab0d1b249600

  • SHA1

    cb5ca23ac58e1d91114277efbaf7b7197036600b

  • SHA256

    0fb02e96a51d855b8399f2bbde7f3cd8be95f5f0c32a81a37a729f0a7c4b0fee

  • SHA512

    8ea651846151091728960154b7b81c0376a69e6b3dedffa4c32ed2137519d9e9f5337ba7d667c14d93688642ac7e5a0583c6c1434389b0b62dbe788879b7a247

  • SSDEEP

    24576:2wofAua4rEtGq/4Df38xG+Sc9vAi7g5QDTTLRcgUNy1xvTpW2bggez:hqQYq/4jXNavAi7qQff2TQNr0gez

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      0fb02e96a51d855b8399f2bbde7f3cd8be95f5f0c32a81a37a729f0a7c4b0fee_NeikiAnalytics.exe

    • Size

      1.0MB

    • MD5

      23017d22578e187125c0ab0d1b249600

    • SHA1

      cb5ca23ac58e1d91114277efbaf7b7197036600b

    • SHA256

      0fb02e96a51d855b8399f2bbde7f3cd8be95f5f0c32a81a37a729f0a7c4b0fee

    • SHA512

      8ea651846151091728960154b7b81c0376a69e6b3dedffa4c32ed2137519d9e9f5337ba7d667c14d93688642ac7e5a0583c6c1434389b0b62dbe788879b7a247

    • SSDEEP

      24576:2wofAua4rEtGq/4Df38xG+Sc9vAi7g5QDTTLRcgUNy1xvTpW2bggez:hqQYq/4jXNavAi7qQff2TQNr0gez

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks