Extracted

• • Target

    b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe

  • Size

    202KB

  • MD5

    b9753e6a4e25385083221adf8dc6d5b0

  • SHA1

    ba627129085d90cff569c40e65649155edc0572d

  • SHA256

    c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d

  • SHA512

    6ee9bcaf5eff303ebcf7d7992635bd5244cead4051ee42a87c5fd8dbdc67786c8c2434dc5ccc5536f4f01d51d416ed3cacc4d9487ce7cfaa6c1445a0b0a79bd2

  • SSDEEP

    3072:114/IIhEDnmJL+ulN45BwNSoRZ7HYIh5PihD1Ypwh1shYeex+tvton02:1be4zwSoRZ7vSJOiAhY+tVonn

  Score

  10^/10

  xloaderzgtbloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    hybreieskm.exe

  • Size

    5KB

  • MD5

    3fe13edd25a0779eb87727b4ce3d7818

  • SHA1

    16527b946c3694d83d3e7d8c452ad681a678208f

  • SHA256

    fce6d2715739d7b855a83771d1c6a3e2822d625ca490b990a2908afba8df1dfe

  • SHA512

    fd2b1a8cbd4bc408d3ca283389ba4a87c8421837f8edfe3b98e1bf9ca3a478369103f8cc57a8f8b3d364e637b30c3eafd423249b5ceb4f2e3cc13ca02db44cf4

  • SSDEEP

    48:vpgnzgb33oMBogjqnWDcsVpXUypXUBq+3nNZ8QN6WNSqG3Y+O1z55quQvnRh:BfjDvbXlXR+3NHoWryY+O1z2uuRh

  Score

  3^/10
  behavioral3behavioral4