Extracted

• • Target

    28c076e3a0815cd225619f3cdabeba20_NeikiAnalytics.exe

  • Size

    120KB

  • MD5

    28c076e3a0815cd225619f3cdabeba20

  • SHA1

    51be4e79e24e6487e33ddbe10ff1c12359019db7

  • SHA256

    7c249a59ef6deb2212ca8ee30590d8f6e16c184926feb21bf4c983bc104434a5

  • SHA512

    5e63d41d42d1483a33b914bd40fbd408d7c3e4a38258ab3a19684b443ad06d37670fa8ebe073f94688fbdcd5cbc18f70fc7dbe354200a816ae962bded2d9f49f

  • SSDEEP

    1536:ZKjVYBp9wz8aVoyN4HkTXRH7i7i8zKhhlr9n+BEePmbkn:ZKhYBpE/N4HshH2x+hXrl+BEeObkn

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2