Extracted

• • Target

    1516df5fcbe41b1cf6e2755fcd37b380_NeikiAnalytics.exe

  • Size

    120KB

  • MD5

    1516df5fcbe41b1cf6e2755fcd37b380

  • SHA1

    f0087befdbcbb0e07784404e221ad02ebbc0525e

  • SHA256

    1e64123f2c7f8cf18b45ab19f159bde33c239405d1d99e06e261ed0cd11dbbdf

  • SHA512

    91658ad0332244c5999739a35c70b8de0b34d3b604c4cc7763b685d7159ca26b7d1d358c5c5191cf5c8a30d161d2734ad3df3127ff1ec79b73011b82b1653821

  • SSDEEP

    3072:jM2rym3Y3yVLnxkYI5E0ypXSqOC5u5thOU44p33p:jPY3AxT5S7XPHd33

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2