Extracted

• • Target
    4c7adf51d74764fc83d628e9a8cc9c60_NeikiAnalytics.exe
  • Size 1.5MB
  • SHA256 b24d01edb8b76471a6c715b3a8c76d91a20465cea1c5f3a07d3d47f0ea6ccd90
  • MD5 4c7adf51d74764fc83d628e9a8cc9c60
  • SHA1 1a304eab976069218440a5aa9d4ec3a3d89638d8
  • SHA512 b1a41d266c6b685de4b1bd62ff3048c30e9032a65942f4444c9873ba84dc273c447f27a4a5685d29ba345d5346a7fa95e4cad254f7c5ef904f5f4306a0923009
  • SSDEEP 24576:XuhYGACNtzlz116k7GXySXNY/zOQb/WV6VDyXi4M7bxKfeJpfSSj1:XuhplNtzlz1MyS7XNySmOVcDyM5tDN1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorbootkitevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2