Extracted

• • Target

    f300cc7b25b3cc0767bacd55617efb90_NeikiAnalytics.exe

  • Size

    3.2MB

  • MD5

    f300cc7b25b3cc0767bacd55617efb90

  • SHA1

    ecf5e85d3089f557f155a1c4e7af2c4e00679262

  • SHA256

    4800634bc6e630962358d178d47050827938391efec2d1658a88c9575a961c3d

  • SHA512

    b468bf870983fc2d2af5cefe218806c4d7a57f088a58f3a7ffe17c2380e201198542150164b2a97329e47b9800b5da0771e1061586cb343d8f552a753158c092

  • SSDEEP

    49152:Bjzc1Bx65LyLql32xfI2+D6gavP76nfpi0nj9q3j84qD0jBmx40dUctPZ5:1wY5Lgqlw/+DeeAkjoj+0jBmx40vP

  Score

  10^/10

  metasploitbackdoorevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2