Extracted

• • Target

    ab45fc0caf837c513d3b5be1ebea1100_NeikiAnalytics

  • Size

    120KB

  • MD5

    ab45fc0caf837c513d3b5be1ebea1100

  • SHA1

    d4d78eb3f0e8149a695ba6fc39b744795a2dfc2f

  • SHA256

    a4f986fe964f9181d27bb2c97bcec3db7d08d56b143d2ff37026bcdb7ba0be7c

  • SHA512

    d353b4cb7374a9ef85ed60302c9033973a0d50508dfd85f8be383ae4310ddffd06c7980c81d0948732a890d183e205d2d69b913a867a6ae1cbdd41375777a397

  • SSDEEP

    3072:pW5qQ+of9pVRtwWFIHEvy+z5d5LE+WdJA:pmqVwGWeOyiZEJ0

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2