Extracted

• • Target

    d77b163e301ebaf8e6545e027dc26ba0N.exe

  • Size

    120KB

  • MD5

    d77b163e301ebaf8e6545e027dc26ba0

  • SHA1

    58bdd4e4fbd6edcbf905fd0950a1a3c61c6ec70d

  • SHA256

    71d9b280c8bbd2a3a6af56016759bae252c12d0415d3c715c90b9e5ea6708513

  • SHA512

    4a4566880bbf2ce1d747dfde2a04764299a76e2dfc3841388d4a6a576dfe9f081e35d3b69c8ae704747996ebc05e5ff38e9e801953f6721cdcb7a7d0313d8440

  • SSDEEP

    3072:iHAeU8fHHW/27wpFlfah51YmA+IhKlUmrxv:iR2la71YmA+AyUmNv

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2