Extracted

• • Target

    208992fff94e0cf721fa83b114d00bf0_NeikiAnalytics.exe

  • Size

    31KB

  • MD5

    208992fff94e0cf721fa83b114d00bf0

  • SHA1

    0d8a8f706504b372d8ab97a94794297a63ea086c

  • SHA256

    152c1bfa242de3f54aba5421b69c20d50bbd40c4cb536c2f2d67c1c150e1e8dc

  • SHA512

    11ea5d2f118bed146343a154027288a2ad6f70f844ba2a03a8674eec1756e820cd9401dc488b5ef8bc2922ca67ac5ff4bd400ac788cad151034573a2f99cfb57

  • SSDEEP

    768:EPorDp8pdvXyzx9uFwna/5nW3TvanQmIDUu0tijwj:Jw68nQbkQVkBj

  Score

  10^/10

  njratmybotevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2