Extracted

• • Target

    30dc2290b6b7bad31e59c18d4550117c79a7c36aeb09ca5f54714579adce11a2_NeikiAnalytics.exe

  • Size

    808KB

  • MD5

    97f0e987446dc19d888bff693ae44eb0

  • SHA1

    5f8f941d3197cb6c0b314e966d677ad3e340594c

  • SHA256

    30dc2290b6b7bad31e59c18d4550117c79a7c36aeb09ca5f54714579adce11a2

  • SHA512

    a5ee9ee3779ea9e579f7f41d0a98d433f2b0f12ee64f6f234612a53b1b29772b7384ecbcdef262dff68ca113a8eea8135e19321fa4efc1fca329acf0e1801e44

  • SSDEEP

    12288:iRhNJJWyiyLqgqXGb0krJIDnv44WpPCaq8hFVZwyWgG0DOFdgf0FBPdAA:wWuLqCOT44WphTZjGPFdBA

  Score

  10^/10

  vjw0rmxwormexecutionrattrojanworm

  • Detect Xworm Payload

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2