Extracted

• • Target

    bc5842609b03cf8fe919fe191f70d870_NEAS

  • Size

    120KB

  • MD5

    bc5842609b03cf8fe919fe191f70d870

  • SHA1

    16dc5f52aaaf2386eee9033e31a49116421d1d27

  • SHA256

    7c3ee085d90222b6ed4bbf24f0d320636b075d62a9e47acd03b75540ca411c43

  • SHA512

    de18b275041e21100ae363d14b75a45e00ff8477640634802368da20d9431fa7dc73ea520c9f7cd7722930f53d8128d6a5891d2057f39a4dd277580ec11256bc

  • SSDEEP

    3072:u++LfR6wtBaWMrNnamkdrIYkuYYtLjE9zTu97L:JgfRNWaRdkuXtPEVY

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2