Behavioral task
behavioral1
Sample
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
-
Size
36KB
-
MD5
5f500bf425159642df0533f6cc76ad70
-
SHA1
5b0f9d99b7c10092fa3579eee44dd4ef30a2e18d
-
SHA256
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01
-
SHA512
e11d34dca0d0d73a1cd40e91574cda0cb4a0f70c6b1032713b5e22560fec3cbb1c38bb9aa7ff6bb4f2762454dfa2bd18cf12add1d847ef14d255ac8a9703cf9e
-
SSDEEP
768:+mfjwQzmBOYMZeQEDNpPv0c3q7QZJxhJkn4l11uy:+mjzm8vzsEZaJxhS4Buy
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
Files
-
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
340026c2a99ff022ef9842ce1e43801e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_beginthreadex
sprintf
rand
atoi
_except_handler3
free
realloc
malloc
??2@YAPAXI@Z
__CxxFrameHandler
_ftol
memmove
??3@YAXPAX@Z
kernel32
GetStartupInfoA
Process32First
Process32Next
lstrcmpiA
ReleaseMutex
CreateThread
GetCurrentThreadId
ExpandEnvironmentStringsA
DeleteFileA
OpenEventA
GetLocalTime
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
lstrcpyA
Sleep
SetEvent
InterlockedExchange
CancelIo
WriteFile
SetFilePointer
CreateFileA
GetFileSize
ReadFile
GetWindowsDirectoryA
GetFileAttributesA
CreateProcessA
lstrlenA
TerminateThread
lstrcatA
GetTickCount
GetLastError
GetCurrentProcess
HeapAlloc
GetProcessHeap
VirtualProtect
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
GetModuleHandleA
GlobalMemoryStatusEx
GetVersionExA
GetSystemInfo
user32
OpenInputDesktop
GetThreadDesktop
GetUserObjectInformationA
SetThreadDesktop
OpenDesktopA
GetInputState
GetMessageA
ExitWindowsEx
wsprintfA
CloseDesktop
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
shell32
ShellExecuteA
ws2_32
WSAIoctl
setsockopt
connect
WSACleanup
gethostbyname
socket
closesocket
recv
select
send
getsockname
gethostname
WSAStartup
htons
urlmon
URLDownloadToFileA
ole32
CoInitialize
CoCreateInstance
wininet
InternetCloseHandle
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE