Extracted

• • Target

    9f4507cfc67278bdf47e2ba1ec2f0cf445fc63703213fd983b90394acacab142N.exe

  • Size

    120KB

  • MD5

    f0c8288cc6dc225b1db902a84e4ffbc0

  • SHA1

    6bea47dbbbfc0ac78d2cfa8ef2b698c7ea1fdb35

  • SHA256

    9f4507cfc67278bdf47e2ba1ec2f0cf445fc63703213fd983b90394acacab142

  • SHA512

    a2db9842f85927bede519297ec57697e6d257473df9a66c20281303f35d684464850cde1eb9328563e5b12bcca8d634dec0f98ad4fe51709a6e953108c2bf2ae

  • SSDEEP

    3072:79MvdYipneTiQ85dkWH3xWD2EP+ED40zN:w1deTXY+AxWHz

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2