Extracted

• • Target

    b6d204cf96e004b32efbeaae6852962b_NeikiAnalytics.exe

  • Size

    152KB

  • MD5

    b6d204cf96e004b32efbeaae6852962b

  • SHA1

    549abe4a13e5aa2c6f78b2e5dce3408641568c96

  • SHA256

    6b4f87b48c72cb08688413039bed57be6882933ead00949e7d85f582a504f1e8

  • SHA512

    ed7293f46e23297876d176cfe97a9db4715f2328b5a505b129a39ff991ad9e6e9923453531c698cedc19db0aaf765c3510df2e074db0a42ea7191c22887b46f8

  • SSDEEP

    3072:321sD4b3JiD3GWguwp07jyAKR9G6yx9zwxqpoSEQYynmL:kcKWt75oqLY8mL

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2