Extracted

• • Target

    86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics

  • Size

    113KB

  • MD5

    86a9fd7269d1fadb204a7612df599e50

  • SHA1

    7e404cb4f315312d6f37b61c46f2e54ddb038728

  • SHA256

    3243f9b754342412b3dfdcdb6b3dabeea1388ee94ee32af129ceec5d8097799b

  • SHA512

    02d7625060a1fb7c3751e66177633818a490b932744f4551b9543eb599ff92c1d2b1e3133dee87a1bba548227b66a4bd5059523a7c7fc3d95a3f5792d8df5c31

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiatS:P5eznsjsguGDFqGZ2ra

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2