Overview

overview

10

Static

static

10

20867664e1...cs.exe

windows7-x64

10

20867664e1...cs.exe

windows10-2004-x64

10

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20867664e1e1d78248901f8574aa9924548405d8547fa7bf65413294e87ffbab_NeikiAnalytics.exe

  • Size

    3.9MB

  • Sample

    240628-1pjelsshnd

  • MD5

    e01943fba69988f32d0b71d440ad8410

  • SHA1

    c68c2e3cb2af942b929a70808fed0e3eb13b0d9c

  • SHA256

    20867664e1e1d78248901f8574aa9924548405d8547fa7bf65413294e87ffbab

  • SHA512

    acb12aecd029b273e4bb465945450df5987cd9f88982411cdf42757f10cb41010b87f1a1e11af62d82a8324fe13a6c203d78f9dfffb4160be58c3dd40d5d3707

  • SSDEEP

    98304:tvgDwcCCpaHZSmWJcEwKuJE8KdOuEEfM7paH6VnwqKkP3y:t/XHZS5aEwxnK5DM7py0nw1Yy

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.146.142:4456

Targets

    • Target

      20867664e1e1d78248901f8574aa9924548405d8547fa7bf65413294e87ffbab_NeikiAnalytics.exe

    • Size

      3.9MB

    • MD5

      e01943fba69988f32d0b71d440ad8410

    • SHA1

      c68c2e3cb2af942b929a70808fed0e3eb13b0d9c

    • SHA256

      20867664e1e1d78248901f8574aa9924548405d8547fa7bf65413294e87ffbab

    • SHA512

      acb12aecd029b273e4bb465945450df5987cd9f88982411cdf42757f10cb41010b87f1a1e11af62d82a8324fe13a6c203d78f9dfffb4160be58c3dd40d5d3707

    • SSDEEP

      98304:tvgDwcCCpaHZSmWJcEwKuJE8KdOuEEfM7paH6VnwqKkP3y:t/XHZS5aEwxnK5DM7py0nw1Yy

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      15KB

    • MD5

      05bf02da51e717f79f6b5cbea7bc0710

    • SHA1

      07471a64ef4dba9dc19ce68ae6cce683af7df86d

    • SHA256

      ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5

    • SHA512

      c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6

    • SSDEEP

      384:ESC43tPegZ3eBaRwCPOYY7nNYXCv/Yosa:EbTgZ3eBTCmrnNAx

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      466179e1c8ee8a1ff5e4427dbb6c4a01

    • SHA1

      eb607467009074278e4bd50c7eab400e95ae48f7

    • SHA256

      1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

    • SHA512

      7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

    • SSDEEP

      192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc

    Score
    3/10
    behavioral7behavioral8

MITRE ATT&CK Matrix

Tasks