Extracted

• • Target
    f300cc7b25b3cc0767bacd55617efb90_NeikiAnalytics.exe
  • Size 3.2MB
  • SHA256 4800634bc6e630962358d178d47050827938391efec2d1658a88c9575a961c3d
  • MD5 f300cc7b25b3cc0767bacd55617efb90
  • SHA1 ecf5e85d3089f557f155a1c4e7af2c4e00679262
  • SHA512 b468bf870983fc2d2af5cefe218806c4d7a57f088a58f3a7ffe17c2380e201198542150164b2a97329e47b9800b5da0771e1061586cb343d8f552a753158c092
  • SSDEEP 49152:Bjzc1Bx65LyLql32xfI2+D6gavP76nfpi0nj9q3j84qD0jBmx40dUctPZ5:1wY5Lgqlw/+DeeAkjoj+0jBmx40vP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoorevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2