Extracted

• • Target

    229a7602ab4c3c176851f5854c281190_NeikiAnalytics.exe

  • Size

    110KB

  • MD5

    229a7602ab4c3c176851f5854c281190

  • SHA1

    1fd792697577f6990035520700db378ff5a0fede

  • SHA256

    824aaf2c3275a86998c3fbd46a865d7749de2496a804bcc85de18d33d2a4e58d

  • SHA512

    b508629460abf888434c9c72d97f9372f1c52de6fcd3d467596a4cd395e579a979408f96ff4dd6f70824c354abd684d658f841dc137406ed088cbc0d8d011424

  • SSDEEP

    1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73Bw:w5eznsjsguGDFqGx8egoxmO3rBw

  Score

  10^/10

  njratneufevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2