Extracted

• • Target

    NEAS.4ff669a8721b5440dc1d3bc343fe2aa0.exe

  • Size

    200KB

  • MD5

    4ff669a8721b5440dc1d3bc343fe2aa0

  • SHA1

    a4c5f4ae4ea7f91554e5cecc412bd93c928d6b96

  • SHA256

    f88d8868352761392ef37cbdebcdfc70bc063f3675b3c0981cc2c6ef9d4acaa4

  • SHA512

    aab643d1cf8a0fc822c4692057fcc67d91f9a32e3dc31a7c31a2f98dc6446560b2edce074884e5ee78097ba824982f6da9c17671ee981c482c68472ff4afa209

  • SSDEEP

    6144:cjsIGmq3ZvLPpiI4lG1e6C2RpUkZ+RdDKB/Hd:cjzvqJoG1FC2fTZ+RdU9

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2