Extracted

• • Target

    8962cb43e5a0adb27b5c2622f8a139e0_NeikiAnalytics.exe

  • Size

    116KB

  • MD5

    8962cb43e5a0adb27b5c2622f8a139e0

  • SHA1

    d68926e5fbd5c776539288f840b553f4314715f9

  • SHA256

    487da21bdd15fd642bb082791d1d43d920c884e36283bf5eeba37337d8f0eab2

  • SHA512

    327747b2290f4b54a8be950b148bee3cc78d0e1fbd19a612710a3c899c25b26d196f5aab97466c8fc0e618cc6b99bf9839209442ad38d9dea9bbf2780518892c

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLI:P5eznsjsguGDFqGZ2rDLI

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2