Extracted

• • Target

    873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe

  • Size

    12KB

  • MD5

    873a1e2ab5cd98979796cc8b3c3f66f0

  • SHA1

    6718139b5d776255705f629a6401796c51eece6f

  • SHA256

    343ede22fe4ea40332033bb21aa899d9adbc2bacbae9fdddeb1380f8f47b3554

  • SHA512

    4c8bd119704358f7dd0170fb49fae206ef2f896c6bea689e3be747134b89c7738c0568eed31fc36666912505cb389608c3c88dd81b4662f0a60fb7811050e458

  • SSDEEP

    192:hV2bkl73eFDvjyNaWjpC5+ZLbaYWL3RmmxWyQVLSLrLQv88VsemfMSEsYz:ykV3eFDvjmLiLhmmxWyQVLSLrL08us9G

  Score

  10^/10

  quasardillyevasionspywarethemidatrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2