050dee559bf0d315e597df9f8c6bc4610c7575a802559c4d429c58e7a522f607_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

050dee559bf0d315e597df9f8c6bc4610c7575a802559c4d429c58e7a522f607_NeikiAnalytics.exe
Size

9.6MB
MD5

4a25797e351612fea564d7cb5a6d62f0
SHA1

dc3b965bfe1fba26602a1b885c2b6ea92b0c0fd9
SHA256

050dee559bf0d315e597df9f8c6bc4610c7575a802559c4d429c58e7a522f607
SHA512

9715966847eeb265d7a88d285d54876f4ce58b6c0e3d8fe6079dd0275f5fa9f8efbd3bc093d798eb0db65fac17f2e60171341d0537c7b43e7398cfedcb04c449
SSDEEP

98304:t+Dm260p0npu+wI8UY8tE+JrgSS/OTuA3g:t461npu+wI8UY8tE+JrM/OS

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource yara_rule

sample embeds_openssl
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

050dee559bf0d315e597df9f8c6bc4610c7575a802559c4d429c58e7a522f607_NeikiAnalytics.exe

resource	yara_rule
sample	embeds_openssl

resource
050dee559bf0d315e597df9f8c6bc4610c7575a802559c4d429c58e7a522f607_NeikiAnalytics.exe

Files

050dee559bf0d315e597df9f8c6bc4610c7575a802559c4d429c58e7a522f607_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

fbada7a52f1fbc6f0e8c125d1804db3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

inet_addr
htons
inet_ntoa
sendto
recvfrom
WSASetLastError
ntohs
gethostbyaddr
gethostbyname
getservbyport
WSAGetOverlappedResult
WSARecv
WSASend
WSAIoctl
getservbyname
accept
bind
listen
shutdown
htonl
ntohl
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
setsockopt
getsockopt
ioctlsocket
connect
__WSAFDIsSet
getnameinfo
WSACleanup
WSAStartup
send
select
recv
getpeername
getsockname
closesocket

iphlpapi

GetBestRoute
GetIpAddrTable

shlwapi

PathIsRelativeA
PathIsDirectoryA

kernel32

LCMapStringW
GetLocaleInfoW
IsValidLocale
CompareStringW
GetTimeFormatW
GetDateFormatW
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
SwitchToFiber
DeleteFiber
ConvertFiberToThread
CreateFiberEx
ConvertThreadToFiberEx
LocalFree
FormatMessageA
CreateFileA
FindClose
FindFirstFileExA
FindNextFileA
SetFileInformationByHandle
GetCurrentProcessorNumber
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
GetCurrentThread
GetThreadId
GetCurrentDirectoryA
CreateDirectoryA
DeleteFileA
GetDiskFreeSpaceExA
GetFileAttributesExA
RemoveDirectoryA
SetFilePointerEx
SetFileTime
DeviceIoControl
GetSystemInfo
GetSystemTimeAsFileTime
MapViewOfFileEx
GetModuleHandleA
GetProcAddress
CreateFileMappingA
MoveFileExA
CreateHardLinkA
GetComputerNameA
GetFileInformationByHandleEx
TlsAlloc
TlsGetValue
TlsSetValue
FlushFileBuffers
WriteFile
ReadFile
FlushViewOfFile
UnmapViewOfFile
FindFirstFileA
GetFileAttributesA
GetFileSizeEx
LockFile
GetUserDefaultLCID
GetTempPathA
GetLocalTime
MapViewOfFile
MoveFileA
ReplaceFileA
SetLastError
GetCurrentProcessId
GetModuleHandleExW
TlsFree
VirtualAlloc
VirtualFree
CreateFiber
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
GetSystemTime
SystemTimeToFileTime
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
InitializeCriticalSection
TryEnterCriticalSection
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
GetEnvironmentVariableW
GetACP
GetStdHandle
GetFileType
GetModuleHandleW
Sleep
ConvertThreadToFiber
RtlVirtualUnwind
LoadLibraryW
GetCurrentProcess
TerminateProcess
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetVersionExA
SetConsoleCtrlHandler
SetConsoleTextAttribute
HeapReAlloc
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
FreeLibraryAndExitThread
CancelIoEx
ExitThread
CreateThread
ExitProcess
LoadLibraryExW
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
EnumSystemLocalesW
GetConsoleCP
HeapSize
SetStdHandle
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
UnlockFile
RtlUnwind
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
GetStringTypeW
InitializeCriticalSectionEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
AreFileApisANSI
WaitForSingleObjectEx
SwitchToThread
GetNativeSystemInfo
RtlPcToFileHeader
RaiseException
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetLocaleInfoEx

shell32

SHGetSpecialFolderPathA

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

rpcrt4

UuidCreateSequential
RpcStringFreeA
UuidToStringA

advapi32

OpenProcessToken
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
LookupPrivilegeValueA
AdjustTokenPrivileges
DeregisterEventSource
CryptGenRandom

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertOpenSystemStoreW
CertCloseStore

user32

MessageBoxW
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation

Exports

Exports

argon2_ctx
argon2_ctx_mem
argon2_encodedlen
argon2_error_message
argon2_hash
argon2_memory_size
argon2_select_impl
argon2_type2string
argon2_verify
argon2_verify_ctx
argon2d_ctx
argon2d_hash_encoded
argon2d_hash_raw
argon2d_verify
argon2d_verify_ctx
argon2i_ctx
argon2i_hash_encoded
argon2i_hash_raw
argon2i_verify
argon2i_verify_ctx
argon2id_ctx
argon2id_hash_encoded
argon2id_hash_raw
argon2id_verify
argon2id_verify_ctx
clear_internal_memory

Sections

.text
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 662KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbada7a52f1fbc6f0e8c125d1804db3d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

shlwapi

kernel32

shell32

bcrypt

rpcrt4

advapi32

crypt32

user32

Exports

Exports

Sections

.text Size: 7.4MB - Virtual size: 7.4MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 96KB - Virtual size: 662KB

.pdata Size: 274KB - Virtual size: 273KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 55KB - Virtual size: 55KB

.text
Size: 7.4MB - Virtual size: 7.4MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 96KB - Virtual size: 662KB

.pdata
Size: 274KB - Virtual size: 273KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 55KB - Virtual size: 55KB