Extracted

• • Target

    NEAS.9df19f7d25ef9172a530ccbb890d063b_JC.exe

  • Size

    65KB

  • MD5

    9df19f7d25ef9172a530ccbb890d063b

  • SHA1

    a47b2981fcebfdac63674e165f95386faacac42a

  • SHA256

    941a5f6eca931fa2992924f4e4790fb1881ae50d29bea094bd433b271aac7197

  • SHA512

    210fd96e5da5ddf908ee58bd8e02df397a2d4841e6f308d40acf94a73657e9c8565ab72f0b82daaa8d309af15ad98946e71f3b3c4c91c42621c6f33cc29bcb43

  • SSDEEP

    1536:KjK1lQ0JlBtjbZ0ExSA4hFEJMyHFlByZRqzdD:j9jbZ0EoFB0FlBG2

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2