98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39

General

Target
21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
Size 6.0MB
Sample240716-tqbb3azhpn
SHA256 98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
MD5 21353d65b457518570bffc8a03038ee0
SHA1 b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d
SHA512 a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282
SSDEEP 98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Users\HOW_TO_RECOVER_FILES.txt

Ransom Note

Your network has been chosen for Security Audit by EMBARGO Team. We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems. You must contact us before the deadline 2024-05-21 06:25:37 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/ Do not modify any files or file extensions. Your data maybe lost forever. Instructions: 1. Download torbrowser: https://www.torproject.org/download/ 2. Go to your registration link: ================================= http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8 ================================= 3. Register an account then login If you have problems with this instructions, you can contact us on TOX: 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47 After payment for our services, you will receive: - decrypt app for all systems - proof that we delete your data from our systems - full detail pentest report - 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan IMPORTANT: After 2024-05-21 06:25:37 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed. If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers. WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators. If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.

URLs

http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/
http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8

Targets

- Target
  21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
- Size 6.0MB
- SHA256 98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
- MD5 21353d65b457518570bffc8a03038ee0
- SHA1 b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d
- SHA512 a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282
- SSDEEP 98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion ransomware spyware stealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (7424) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1