Extracted

• • Target

    2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe

  • Size

    542KB

  • MD5

    2e31947b461d41f8841ad6b7599da1c0

  • SHA1

    34397666cc9b7cbfc64cd87412b45796db7ebffc

  • SHA256

    842e36c3341012b2b4a4ba93306a9f341f150f124c67f2b839ea8c9ed489e3b4

  • SHA512

    85f2a89a7d0838eef2fe9112e0f7906e86e31a5b67a512ee171ebab0133184be80d3fadfca2c7f105d6b6ca4fad6715b7cf74d8f05d5a57b201bd025b93339cc

  • SSDEEP

    12288:C2/3R2TiOL8nBzcI8maanZ0qA/lf1DDZtmGfvvr9KfaajUIRKJCDPNKT1zH3/Iv:C278NaWr9KfDjUIMoDu173/Iv

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2