Extracted

• • Target
    502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe
  • Size 292KB
  • SHA256 bac724d6a090749660d5ed5b5694f9d989ec1d32fb9988d1f0798b6b38b50afe
  • MD5 502245fea9ce9736de775c587cfc2eb0
  • SHA1 bd5fceb952019c1ab15e90e2c0d6294eada8011f
  • SHA512 0dd3afcb478f53ae24879418ab28b424e014b37ffc6f8e544fe62564189249e37f5514a98dff73c39f3100803a06a6cf54c3e8e36334990c9ac47ce7ec4f1245
  • SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETt:mEFN+T5xYrllrU7QY6wLkIo6A9t
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Detects BazaLoader malware

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

    trojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2