Extracted

• • Target
    a22922cba62b835d2678e89171c34ef0N.exe
  • Size 231KB
  • SHA256 768f9b0b8ef122996a9759ad090764b17d78d017f7c6f1d9959c431e351414e0
  • MD5 a22922cba62b835d2678e89171c34ef0
  • SHA1 79d46a1455b930f9740b156290028b17e71da286
  • SHA512 55ecc818ccb67371c6f38ab5264d04348ddd409710546c610bf060460af481e6c71374f36230ee15c65c745a2d4284f4e14a8e8873f4fc50794a48318ffc1afd
  • SSDEEP 6144:4V8+nNevUVHRPl0XANIsQvMRlkM4RD/qzMfUt:4V8CNHjNIAQMRGM4h/qofc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  floxifsalitybackdoordiscoveryevasiontrojanupx

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects Floxif payload

    backdoor

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2