Extracted

• • Target

    79cf7560b7c62a56499d67d4ed3aaf90_NeikiAnalytics.exe

  • Size

    115KB

  • MD5

    79cf7560b7c62a56499d67d4ed3aaf90

  • SHA1

    b667a1fbaca0227513f75c6a7b7916f1d5f77857

  • SHA256

    c0455d54c58449c1cb2a5e180d5cf4957f6de9117c4a7ae57c943cf62c3296cc

  • SHA512

    ee71a09d09dc4780ac18243f28fd8a99c56e6df1fa33f0e1bd215f5499e0952cdbf44116b8dfde54fd5c09d781430a63490b75e9495811fb27750e093bc7cdb8

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDIAC:P5eznsjsguGDFqGZ2rDIp

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2