Extracted

• • Target

    08cc3cc5f15539bf45636a0c4f0188e0_NeikiAnalytics.exe

  • Size

    178KB

  • MD5

    08cc3cc5f15539bf45636a0c4f0188e0

  • SHA1

    37d99c3454166a8147b0b704b18022530a78d32b

  • SHA256

    0b659b5fef0f68ffc2c533e5df1040332fe9f9adb45f29514d81a5678c9f71e9

  • SHA512

    5f0477dae2dfcf41855a830c53472f80d43d45fce7d723cab5e9c5dce6f59e58af034c0f88f7c1a7d67b2850f62bbea2e7d7efcf3325ecbb5c4632f95b959b65

  • SSDEEP

    3072:9Gu9BlfzWIbXWm+w0JI5Rjv2aduB8lro9T/djPA9GECspGKdPEKEeuYFf7sL1:9/0uoHKUJlE9GECsBdOI7U

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2