Extracted

• • Target

    1736a832cafbac097433f84033ea7c70_NeikiAnalytics.exe

  • Size

    2.0MB

  • MD5

    1736a832cafbac097433f84033ea7c70

  • SHA1

    1f13ed7a868bd40edcddb8c5feba023e332491bd

  • SHA256

    e66f528346aa015cdf1997278feb255f8fab62a0c73c2c8ca39545e348dff32c

  • SHA512

    dbb360b9c104fa8b6c19a4529467e8f0df7cc71f68fe17538e320858a8b31a7bb3b4d04b57486b46c719f47d41470c37deb509e4fdf5754ec67fe692c4500ca1

  • SSDEEP

    49152:M6j4PJ76i19ThjPKDSRykU9miD6tkhovXx2U3u1P7E0+ygagw:MO4R76Ul0DOWovXx33ud7E0+yz

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2