Extracted

• • Target

    NEAS.4cb2d569462bb2eb69a7cabc37e65470.exe

  • Size

    421KB

  • MD5

    4cb2d569462bb2eb69a7cabc37e65470

  • SHA1

    4b43610163a59e362dc87ee0c2311b5600968764

  • SHA256

    26d8cda3729de60698e2dc69f0a3e180000442bd1cef0d698038b7438058f154

  • SHA512

    5c5776dc5e49d6d5c49a86c625f6ab82a27341057e31a9a8baf39653c509e5985d2285372b06c09d9ad24a40fc4f0e128ded19c81e9e1c3a65f89b2d6aa46dd7

  • SSDEEP

    6144:BWb6GdYJGY1CLKd6Gr5/ZH8XL7k19X0eTLE9AIHR1y9X96DujRJjyGfETlVGR:BWbvhLq6yBH8X3k1lia+ujnjdfExVGR

  Score

  10^/10

  salitybackdoorupxevasiontrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2