Extracted

• • Target

    NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe

  • Size

    1.5MB

  • MD5

    20eb72fd21aeb585531377b97caeacb0

  • SHA1

    e6834dd1f8867df5e28b6ffe7fd493faa1a0c12d

  • SHA256

    210c234f0aa9eb24e3ae39948ae069e41c84a55c1b7117e6489123ad62f656f2

  • SHA512

    f22b663d3b0994a26ab82ba5915e0f05cb9ebe4a7643a4f8a03d5853fcdb9ba7348ff15137617c6f7da46c0d190372ce7d01adefd700b48cee97f8161053f369

  • SSDEEP

    49152:r0ibuGD1U0YRIbehmMA4xp4O8b8ITDnljS:rIRe9S

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2