Extracted

• • Target

    ab10bc1281557ef97eea4042a51c6a40_NeikiAnalytics.exe

  • Size

    120KB

  • MD5

    ab10bc1281557ef97eea4042a51c6a40

  • SHA1

    f92d2be3ef76ed2bd8207ad0c3c48e7555902010

  • SHA256

    c58c31f7ccffa968ac8f59437ede22537fbdbf34ac5aaa5c2b2d19929b105eeb

  • SHA512

    8a21fc8b20acbca1e09b9e2bccd39140062e0e1727c4ced42d74e4f703de0a146c22ee885bcecddce763b7ad0fc765bda2282f50c99816f717bca5886f8a8bab

  • SSDEEP

    1536:/oRTlHSmmvpP4b13eH1rve9+kzJtU+2Z0mI8U0hmYzMjS9jfxbHOyy78/vg:AR5SmmvpI61q9+U23I8UHYQGfe78

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2