Extracted

• • Target
    e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe
  • Size 292KB
  • SHA256 269a7ea3b40b37add4b4c2d4336040d0bd96246294d202a43a509245af99dbac
  • MD5 e2264b6655d9f86350c14dd0a0754420
  • SHA1 d54b398509c8b6f23b800d6eeb1c5257cbd59f2b
  • SHA512 52d3d537b6589cad6ea2bd6c00884e48114d33aee698defb3ecfcd4cd2502275b01e224009552db456ed3eeeb740a45b0a00cc0a142e467bfcd258a9f30b7032
  • SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETY:mEFN+T5xYrllrU7QY6wLkIo6A9Y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2