Extracted

• • Target

    NEAS.4d4916a25ff8009504ba6dd45221e1b0_JC.exe

  • Size

    120KB

  • MD5

    4d4916a25ff8009504ba6dd45221e1b0

  • SHA1

    478b61fe4305d55393b2ba5c81a451aa04cc8fad

  • SHA256

    1ee99e2349d50db3fadaad51fc635114257025d6abbe41f8194321a395560c04

  • SHA512

    0b72e406f79787e95806f9d696f4908ddeaa3e73a7d1620492b8778de5bdd735d58a3e92ad16cc56a3a617a54e790c363cd5f20101a985bd4d99cb55fac53700

  • SSDEEP

    1536:XMDo5SVuvNHVcqlT3i1qG3Ivs2r47Xzio/pxLhfdYzCfsmzU31VoGsM:X3U+IzIE20nf6zNmg3zrs

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2