Extracted

• • Target

    8c4cbea6e724f06f3f068f097a39976b89da366b946153ea3ddde3f9ec369cc5_NeikiAnalytics.exe

  • Size

    117KB

  • MD5

    77bddc2c7bfa245021a0580be8892ec0

  • SHA1

    0fe3f38bfe3481d5827b7cd6a78640b7d74b32a7

  • SHA256

    8c4cbea6e724f06f3f068f097a39976b89da366b946153ea3ddde3f9ec369cc5

  • SHA512

    1481afbcfa94234e9c99cc780f4453846dbae6eccc72501a4e65e1ac5d1f387b669e703b4804a5367cd8bb9702d517b996379a6e565e9bc98fb45159b7a13bae

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL148J:P5eznsjsguGDFqGZ2rDL148J

  Score

  10^/10

  njratneufevasionpersistenceprivilege_escalationtrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2