Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
25ec5a9efacea3c081951a6ea96f6bf2823faff226eeadaa8ec2c5570ff92f98_NeikiAnalytics.exe
-
Size
63KB
-
Sample
240701-agpnjszend
-
MD5
f3f0a9a0a22b6949e0e1471f73bdd370
-
SHA1
fceace4920e671e8bfb4fc133830a38becc8147f
-
SHA256
25ec5a9efacea3c081951a6ea96f6bf2823faff226eeadaa8ec2c5570ff92f98
-
SHA512
7428809f84a617047090e948521dffd1d3c5ffcfd91bb46365e094b5d63252c1a4db182b4893ad2b6f597eb879bcdfc184c526271fb541b0d41975ca09669b75
-
SSDEEP
768:quY6LVcsTPq781wC8A+XjeXgqiudfBSuJwP1+T46SBGHmDbDlph0oXyyzIXSuMdP:DeQPc25j5BnihYUbfh9y0uMdpqKmY7
Behavioral task
behavioral1
Sample
25ec5a9efacea3c081951a6ea96f6bf2823faff226eeadaa8ec2c5570ff92f98_NeikiAnalytics.exe
Resource
win7-20240508-en
Malware Config
Extracted
asyncrat
Default
20.ip.gl.ply.gg:42948
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Targets
-
-
Target
25ec5a9efacea3c081951a6ea96f6bf2823faff226eeadaa8ec2c5570ff92f98_NeikiAnalytics.exe
-
Size
63KB
-
MD5
f3f0a9a0a22b6949e0e1471f73bdd370
-
SHA1
fceace4920e671e8bfb4fc133830a38becc8147f
-
SHA256
25ec5a9efacea3c081951a6ea96f6bf2823faff226eeadaa8ec2c5570ff92f98
-
SHA512
7428809f84a617047090e948521dffd1d3c5ffcfd91bb46365e094b5d63252c1a4db182b4893ad2b6f597eb879bcdfc184c526271fb541b0d41975ca09669b75
-
SSDEEP
768:quY6LVcsTPq781wC8A+XjeXgqiudfBSuJwP1+T46SBGHmDbDlph0oXyyzIXSuMdP:DeQPc25j5BnihYUbfh9y0uMdpqKmY7
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-