Extracted

• • Target

    e9a01cc0fabd7926a466b0d4747a7de0N.exe

  • Size

    1.3MB

  • MD5

    e9a01cc0fabd7926a466b0d4747a7de0

  • SHA1

    63588672e7b6ac22b2b90d57e6f65b720069acf9

  • SHA256

    c313d5737a6f1af3a9bddec299ca67b96d22959c97870cf4ff083b221bc76d4f

  • SHA512

    73aa77eaf239057a64322c1d23935dc664a6cb231074409cade2ff1dfa8e4ea84b83922e271e1dafaa7f235a176b09a2262d184c1d4c8db4d5ad74491744be11

  • SSDEEP

    24576:XshcHDn0KEQQJYQSUzSscB6ymeJYoKWyiTp1bAlJ+ghmsc9s:XsZgDsVymeC/W7Tp1bgJdQW

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2