Extracted

• • Target

    29c7cc4754afdfee5a14fe2e1c029680_NeikiAnalytics.exe

  • Size

    200KB

  • MD5

    29c7cc4754afdfee5a14fe2e1c029680

  • SHA1

    87e4951c35cdf446b9cc72061aab3f92608c0064

  • SHA256

    16014aab4365dd51c62c90d342bcec33bd05003ddc0265df344ef2a0c8da8557

  • SHA512

    cd814d7276f43834dac72a640209d41f0cbba22bd7b2f26ef4e7940a7adebfb2a46173303d957adf7f1c31b7c5a74ffbfa6d06dc7d3b7a7dbecb6d5fe6c3aef7

  • SSDEEP

    6144:wMqWfdNANa/AjNggWEv9XCrrupJywxS9KLFJ5:vqWfdNA0/uNKmSmfx6KP5

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionpersistencespywarestealertrojanupxworm

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2