Extracted

• • Target

    64548fead889deb186a50063950eb570_NeikiAnalytics.exe

  • Size

    120KB

  • MD5

    64548fead889deb186a50063950eb570

  • SHA1

    00014330a9752b0db9fc211304ab87db09ffae1a

  • SHA256

    975896c1dd08536b4787c3034af071a66d191601e69ed0e4a8d0d6d552723866

  • SHA512

    177e6897bd9f0b87c5cd141548122af3238661ef00008adc1756925a62f94f1f8280bcaad48da275b995626ecb7240f6c3ad5756e9f39218f1a9e809ce5b69e9

  • SSDEEP

    1536:rBjWPXhjJi+zAQ/bQCBNkAiqj4FE2dxxYQOMwLnTWIqWebEwg:rBCvhjY+p/cCnkAt4tElxjTxe4b

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2