Extracted

• • Target

    04c2245a6faf7ea6be6ca062788b75b32dcd945b3dd2866963f640c127586757N.exe

  • Size

    120KB

  • MD5

    33b9116f1d32eb7455621e93c9b63070

  • SHA1

    4f6576ea3076000c548d2e8c46eea51ee8ecd01e

  • SHA256

    04c2245a6faf7ea6be6ca062788b75b32dcd945b3dd2866963f640c127586757

  • SHA512

    e99bd834345e7e3f9d13e63658f161ddb3ee3024f6300f1a004a835eada78753f033d019e133a385eaa8d4768219d58ab4fc50990d6bc3ac86a89145cb26a78e

  • SSDEEP

    1536:vlOUMzRKyeT7PFy9SFeWGK5/92AWtxmKya7764MPVOdjszYUpx+Pn47BSdIYqtB/:v0UMlKx7o9jQ/9y+K/6pKgUPno6MR

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2