Extracted

• • Target

    7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe

  • Size

    8.7MB

  • MD5

    7a3371af26d62dfdad19cc434531ae30

  • SHA1

    c0bf27756bf9b8b6164ec41a3029eb931886955a

  • SHA256

    77af1c5d89e5426091051fc29887cce021a4bc4110f94aedc5342cbd5e49c300

  • SHA512

    773a6e66ae40f2a80f142b9621cb1ff0076cb05dcc63c4398a1c5ae60e4fca6f73f2f4882469d4230099ec11eb5bf44c4bbcca2870702f831e8b6b88d54f6f83

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbd:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmR

  Score

  10^/10

  njratjjjevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2