Extracted

• • Target

    10320a8ae99d01a889f097014f12c100_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    10320a8ae99d01a889f097014f12c100

  • SHA1

    fd3ea41f70bce9c39d0058206cc95852e840090b

  • SHA256

    923f1e5c7a1d312cb2245ddc37203949a638d57266a4d67958c4d3dfd42610df

  • SHA512

    1f113498b3877a98c7f61617b0369e93a5bce6e8ede8570c8275d94bfdfd02f07508c688288a5842e730d5c54429144ef3398c70a970540bfc1b1d26c15e1061

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuM3:P5eznsjsguGDFqGZ2r3

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2