Extracted

• • Target

    6828390a111622be9e24f3df47544d60_NeikiAnalytics.exe

  • Size

    113KB

  • MD5

    6828390a111622be9e24f3df47544d60

  • SHA1

    a5b7c55580447b96e8d5226b81cfe73e69396227

  • SHA256

    2690a2153aa9e1448603afd44d2fe5b89bce49f5a24ae8dd7144b1c6125db002

  • SHA512

    f24b5867c95e918ffe6c2ee9ac7432ae59fca37ca3b9d7ee20a5b03c4974116b14cd39813f7b2d6a02d131b0ad53cc5169f516e29be34db79ebdbaefaa41d10f

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMJ:P5eznsjsguGDFqGZ2rJ

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2