Extracted

• • Target

    748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe

  • Size

    7.4MB

  • MD5

    748f98d4289c294ee45a7b8a6c9aa9c0

  • SHA1

    255b8f45a7e994abc1cb3fa97f7d09041888011c

  • SHA256

    74f7d78429b1bca9516da39343118b371d14e6fdb25b8708ff3d32391c84ab8c

  • SHA512

    a4a838f2cedaeb17d61bae3808adc20a8fbaeec48d8a423240c3eb18509f73782822ed499642840a64212196c1f15af7101975c9362576ff9ef257a1095825aa

  • SSDEEP

    196608:SrH5P9VjurErvI9pWjgfPvzm6gsFEB4Auq:YlNurEUWjC3zDb84Auq

  Score

  10^/10

  upxxenoratexecutionratspywarestealertrojan

  • Detects XenoRAT malware

    XenoRAT is an open-source remote access tool (RAT) developed in C#.

    rat

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2