Extracted

• • Target

    NEAS.a6485b363a4a8ebbdbcaeb5c98a6f1b0.exe

  • Size

    97KB

  • MD5

    a6485b363a4a8ebbdbcaeb5c98a6f1b0

  • SHA1

    2000953815a7c1dd63a127b28a49f22498ede722

  • SHA256

    1c9985f4be65c90fc2481ea33700e56a69e7e437d5fe6f402ffd07976ccac703

  • SHA512

    0e32779bdd53eeede1f0d4853d99205ff4ac5a27a5d314b4c939234a310731170f6e8cbaaad64b06e9300b18d2f96d90ec84943caf5368c1cf78c8ed7ee875ae

  • SSDEEP

    1536:R9URRrA6nOgJLndR4jOc5w5NPnqfedhZEseDsffRnvylU+5f1+PTwgQiHb:6q6nVdZ+KnqGdhZE9IfpKlxN18TwgQ

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2