Extracted

• • Target

    1ee6010b28893d32650ef5b56c909190_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    1ee6010b28893d32650ef5b56c909190

  • SHA1

    4c71343fb7bbf00fe702627aaed7c643a5e5c3ba

  • SHA256

    ab98148335c5f04b5e8076b41b17c40e5cd6012ae634083b31a03f163a054e45

  • SHA512

    42ef3213fb35856b011fe3f655b63bb4ef6c752b5f9a22595268e7f21e9341b6bb1c8e7b22079cff16680a15f219880d4690d04b7ca711118f9e29c1f3904802

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuM6:P5eznsjsguGDFqGZ2r6

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2