Extracted

• • Target

    59df9f6f1fcf7b5c7ee6ed0d1d694330N.exe

  • Size

    120KB

  • MD5

    59df9f6f1fcf7b5c7ee6ed0d1d694330

  • SHA1

    c6b5fef993ba38a8af94058f5d036f024efd4c68

  • SHA256

    7400d7a1414a062582fb671cbab89395f61ff0e5967339db58d66b8802117391

  • SHA512

    1974a6fef4bc5d01ce3f2f5eaab749d7db2e380059c3986f7ed01670e998d3e83ccd560baf01b0fe14e556cbc03a3b56a2c3432dec4c8eee8381e24e6fcb4b03

  • SSDEEP

    3072:ANCZvAslBvDhJf2OU8s9piSJNx3wCyRczUGmAE6:KMvAszDDbbIMtOU

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2