Extracted

• • Target

    4bd65857cd398a4f6a73090b6b522890_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    4bd65857cd398a4f6a73090b6b522890

  • SHA1

    c992fe798c6f2af562de3d3ad68a39f8e885e319

  • SHA256

    158fee9987ceffc26395ea885fec4718e9545a8aba743d3e35535ea3acaf9a19

  • SHA512

    a0e5279d022879d355ca604dc67525fcb98b9d92c9927e130b37a6a4699de38899a256f2f16e92f76856134096a00d8e1f403a9abf06e0f64c30dc5e97e6454e

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDQ:P5eznsjsguGDFqGZ2rDQ

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2