Extracted

• • Target

    0b8eaf76fd2161c5af5ecc7c586cfd90_NeikiAnalytics

  • Size

    120KB

  • MD5

    0b8eaf76fd2161c5af5ecc7c586cfd90

  • SHA1

    ca81550ef7396904dda4f7f51046582196dc47e8

  • SHA256

    9fe04619ccd619f9d2736577dd96efd4f6258d91d429b1f8f3766ca0be592ac0

  • SHA512

    5081e9e8cbef15e24a7180fb868d06899ad3f37d87b4457b709d266bf1948e1305e4cf75d767013ae005edc9480532391292369ef186f12fe15b34a95dc2b574

  • SSDEEP

    1536:oDC09IWMdnWR3+y6cz+91MuaLeA0o2H2kSFeTP/ia3GsbkvOUAbBbib5Qtt/Pn8p:iHtlRuy6e+YeA0oKl/DdYG9BGbotnw

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2