Extracted

• • Target

    NEAS.78b3cbd6d4fd9505931154d1e6a92020.exe

  • Size

    120KB

  • MD5

    78b3cbd6d4fd9505931154d1e6a92020

  • SHA1

    3a7444c439f882bce24f4687e6dd58aa15b5e6d8

  • SHA256

    83d256111924fb7bfc814ea52bf873bfc0b1137d9040bbb7965d6d7c8a8adcaf

  • SHA512

    05466875d61adf0454bbe9fa0743f28c59994db8a18cc20b30f02886fed099c1f0888fbfdc6cc3dba18c33ffdb510225b212cb85f680b15f23d06a9269c14990

  • SSDEEP

    3072:rsVsSezgtBAhTHhIKHdM+brrf6bKYE1IlFTfq:rm8maTHhIK99brT6uYuI

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2