Extracted

• • Target

    2583aa32ddaa50284a8d001a68696a00_NeikiAnalytics.exe

  • Size

    7.9MB

  • MD5

    2583aa32ddaa50284a8d001a68696a00

  • SHA1

    e5924ab9a1b0ff6ee9939f92b84552a521f70dca

  • SHA256

    f4f4a763572c82d7e96673adf3d70f6524a2aec4c516db807ce154bdeb1a2237

  • SHA512

    d94c24fdc2008e6fe0cc4eb97f487b638dbb8cb0b7611120a643b41c77bbfa00e49fb15df7c03ce61c782f0b7f628647ed686b57615be17b32457181fc9b6243

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb2:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmy

  Score

  10^/10

  njratjjjevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2