Extracted

• • Target

    ea9fc82a8e9f6a12d560abd29ce254f0N.exe

  • Size

    120KB

  • MD5

    ea9fc82a8e9f6a12d560abd29ce254f0

  • SHA1

    460369833910f1e9c57bb23f7143f4175c5a3367

  • SHA256

    b05f557767f39cab362f088c7544a50475a9c4900889da75791a0f9bbf5eb430

  • SHA512

    9a4f10c5087268cf98413d63c2a529507682fb51a47a955ecd3bf164137b8bc9d6c3c129720809912bf520403039f229363cfca10f09d4b0ad54e2cf76ca9db6

  • SSDEEP

    3072:Hq3rcWdKuU90PBdBXOroxc4Ls1oLMtkEb0i:KQWUyXBXOelfAtkU

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2