Extracted

• • Target

    6a956840344d1bdb0b6b6d834c0098d0_NeikiAnalytics.exe

  • Size

    1.4MB

  • MD5

    6a956840344d1bdb0b6b6d834c0098d0

  • SHA1

    ff9545584eea9bf5f7af24fd578ba9191362eca8

  • SHA256

    2800ab0e7b3b120667b87dcf21ab87d6a3097f0116e2c791d0aa0a04d8ab51fd

  • SHA512

    a883a39eb68ce824079e9cb424100d382bdc38d9506538346d1b4b88391f30ac976061feeef49477cdda1ee55f3117340ad4b4f6db10724c39fbaacde61e95b1

  • SSDEEP

    24576:jD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjoU:jp7E+QrFUBgq2t

  Score

  10^/10

  remcoshostpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2