Extracted

• • Target

    5a95e71afa7321983863504bd04a4f30_NeikiAnalytics.exe

  • Size

    120KB

  • MD5

    5a95e71afa7321983863504bd04a4f30

  • SHA1

    fa0a2516257a5ac1ed6ee6cce187b0e6bb2b7c40

  • SHA256

    d9d3ce0fbbee2339b50632a2074764ce282b376993de9b5a2ca15c1285933a8b

  • SHA512

    7053a9af179cf5c5355f49f251ea842095847ae85fd0eb6e74e76e2627dd9f57a695b6b995ea655a8185466f42ff172968b2eab798a605ab657ae47f9ac8cfe0

  • SSDEEP

    1536:yq6zAcgLaSZ0Wx2jhcVBNdyNK3be65sp5oaO3GzOUNSS9Q8gpVlWNHHKATrmnJue:IsSWx2jUON0bejzyejFQ8g1qHqATinz

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2