Extracted

• • Target

    NEAS.81d6888de9ff514b570558b6ca717ce0.exe

  • Size

    120KB

  • MD5

    81d6888de9ff514b570558b6ca717ce0

  • SHA1

    77ae2f1ff63597924c4737669a5864f9508b8e82

  • SHA256

    62dc79bf443f3d610e36ded5830db5230061833969850651162a6a9524025411

  • SHA512

    411f32ed00c9686d74897ecb3069daac7db60612c7cb65ad57382bcbfafff4770d35561a4771c296520be939149480cb4ddc754aaa748503281e756d80632e46

  • SSDEEP

    3072:PpgN4qeyqNDGA6Sdr7soMYbp9bULfYvmNwt15Wj:Bg+7R7YLfYvbb5Wj

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2