Extracted

• • Target

    9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics

  • Size

    1.5MB

  • MD5

    9c0f25deda5fd180238008b7b97fab10

  • SHA1

    f65d5a0b184c6bc0866ea214b2dbe37135eb6f9c

  • SHA256

    78ce536df6722793cde9eca1bc9f78bc4abe3d17613eb950401c1fbc0335142c

  • SHA512

    6d5c2a12818e8f6b6e0260ef81c18409c9b4319fff3ec7000ccf5b6dfa29b933ccfadcc414f8af83d3ca2c3f7def5f52f1ca649c698691c742e3559a0fb317b3

  • SSDEEP

    24576:8NNGBDaQ3lPIiTr9befL/s20Z7RMnaGq3Lpu/ukPew0t4OH6Lwu69wYzGXIgA/H7:/lVwzl0Z7zGq7ptw0t9RfP

  Score

  10^/10

  asyncratzgratvenom clientsevasionpersistenceratexecution

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • Modifies security service

    evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2