Extracted

• • Target

    5a24cf78cb6054ef0f93726c02aeb7c0d0b2e772b69fb1a9907b6ba8ef8f952e_NeikiAnalytics

  • Size

    1.1MB

  • MD5

    2c4576ca7c0f8abeb6647ca51cd19b2c

  • SHA1

    cac2fdb51c878e8dec6e0f392281a3562ea9ecc0

  • SHA256

    5a24cf78cb6054ef0f93726c02aeb7c0d0b2e772b69fb1a9907b6ba8ef8f952e

  • SHA512

    998472adbb49895a2ee41b3f868b9c61b45bbcb3609296f234ff50fe391098e1c8f9e04c5cd5a14575ea268e229b3ffa8c73949fae4ac541bd7b614a83d6bb45

  • SSDEEP

    24576:6lMAYTFQBeU31HTh/OZHCeTcILzp6Od7b:6lMlTKsi1/OZMIM63

  Score

  10^/10

  executionagentteslaevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2