Extracted

• • Target

    NEAS.645da147f59a5e503ae8522358afe7b0.exe

  • Size

    120KB

  • MD5

    645da147f59a5e503ae8522358afe7b0

  • SHA1

    a4d6da358c5285ea052e0cc6814afb1de6c6a48a

  • SHA256

    037f0188662c0c48c70c69243393446fd89ad3f3a8d4a7a696467709290e3ec7

  • SHA512

    73b1f0dd5dfbd48740a026ccf5c99ca1eb82745b37a45a6a3a20174be88a7ff8cf0955722ecb08739293ac79f3c24f7bfa5402c3affa64716386093da977b35c

  • SSDEEP

    1536:RYBmlO4qF5ZiHCLPGOlFrhIlwlERsluK7gL+2i8YXYOFIxJbIbu2baJE1h:RYBmI4qF5cOj71Ik5lxU+2MebWFV

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2