Extracted

• • Target

    NEAS.fb7ba28fbd31dca8a966e55e19384460.exe

  • Size

    120KB

  • MD5

    fb7ba28fbd31dca8a966e55e19384460

  • SHA1

    3e6309dfba107cd291072fd0655d0e686fa7f293

  • SHA256

    862caa5b45ac28386f3c7808529de14efff7019b8df59de6e5b724686bb6bba7

  • SHA512

    844e55acb21ae7e33f928d36b6463c98b3bf36396358369ae03760ea7095bdeb824f1e2d3bcb97917f6e9b7eb36105b2858a0d82e11baedf39a31b7d19d1064e

  • SSDEEP

    3072:neW+1CxAl5RiLzyYTp8IrydvH14Hc0YL4F:YWAlbknRyTX4

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2