Extracted

• • Target

    4c7adf51d74764fc83d628e9a8cc9c60_NeikiAnalytics.exe

  • Size

    1.5MB

  • MD5

    4c7adf51d74764fc83d628e9a8cc9c60

  • SHA1

    1a304eab976069218440a5aa9d4ec3a3d89638d8

  • SHA256

    b24d01edb8b76471a6c715b3a8c76d91a20465cea1c5f3a07d3d47f0ea6ccd90

  • SHA512

    b1a41d266c6b685de4b1bd62ff3048c30e9032a65942f4444c9873ba84dc273c447f27a4a5685d29ba345d5346a7fa95e4cad254f7c5ef904f5f4306a0923009

  • SSDEEP

    24576:XuhYGACNtzlz116k7GXySXNY/zOQb/WV6VDyXi4M7bxKfeJpfSSj1:XuhplNtzlz1MyS7XNySmOVcDyM5tDN1

  Score

  10^/10

  salitybackdoorbootkitevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2