Extracted

• • Target

    51f28789646af41d049b694138433dc0_NeikiAnalytics

  • Size

    710KB

  • MD5

    51f28789646af41d049b694138433dc0

  • SHA1

    57c4323053589025713656f1ed6cb14e7d05eb59

  • SHA256

    8c865af1a6f5285e6a3ee64421ea74a1bc18963321f2f7bd36e1a3da3ceb9d4b

  • SHA512

    24160456a2b764169b923033e3e9696b24caf3966b2f366a821c80ece051d5484747ffa78fce95fac5f2a2f3dee28082d09e2a1d2a3a6a16133791fcd96bc302

  • SSDEEP

    12288:DB1f++azZ4BENJwb/DrA8gXo9LddVNUT0PWkjQ6x67EKM6K1LQFoHLeBfo:t1f++eQGJEHco9LFqQeX6gwK5K1cmreS

  Score

  10^/10

  zgratevasionexecutionpersistencerattrojan

  • Detect ZGRat V1

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2