Extracted

• • Target

    148b5e93b6867756c918c35dce92db20N.exe

  • Size

    120KB

  • MD5

    148b5e93b6867756c918c35dce92db20

  • SHA1

    d75098980f16931fbd3da8fe5d1ec198a08da6c5

  • SHA256

    2c7ffdbf98061a90a4bacaed5aec79e6d50809f9539d36780125c78e51751312

  • SHA512

    ce7c61bb86dc2257a6e08aae03da5cac28fd6a19ab609d7feaa3585b20ab2509e1ae9e4373f3219a398e4938778a5236b6ae356c806018c5e7b8ac00ce1a4c82

  • SSDEEP

    3072:JM9Q4p12AzYSXXWOATUmyCUQKI7oa9be:i9luI7ATryZS

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2