Extracted

• • Target

    5d532285a3f85c4046f251fe8070b020_NeikiAnalytics

  • Size

    8.7MB

  • MD5

    5d532285a3f85c4046f251fe8070b020

  • SHA1

    50144fe0f70d8fa4f32d790608d1df394983b24d

  • SHA256

    7b47b73ceae7947d66eea37ff2d8d2b71f2ad8317cc88cafb92a6b43c2264cf1

  • SHA512

    7f4b50b695edf70c52924261458485b979219632014c952e3dfc0a1779f3057c7c618f255e3c273e5ee6dda3974c7a859f21923ce99345c7af938f21a73e6283

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbt:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmB

  Score

  10^/10

  njratjjjevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2