Extracted

• • Target

    64cd0c75e14d02b9f423ad2533306d10_NeikiAnalytics.exe

  • Size

    1.4MB

  • MD5

    64cd0c75e14d02b9f423ad2533306d10

  • SHA1

    744ffa6d05ce494fbe61ddcc42e60c060e165217

  • SHA256

    f80b66065daf4e2d61961bb966301e17231ab8ac033f4ece7c612d3a5b66dbbd

  • SHA512

    fc69d92e63d50c3e079f4144f3a9b03d20c0c41256ad777ed460b3bca46ba5aa67dcc7cf8969f8758a06103569b975e8a90b3b2ac8b38bef36a32b82a82af82f

  • SSDEEP

    24576:kD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjoY:kp7E+QrFUBgq21

  Score

  10^/10

  remcoshostpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2