Extracted

• • Target

    5a705a3b6361becbf721b97ce9d56c870dd5492c114d8b1c27378802f88eeab1N.exe

  • Size

    120KB

  • MD5

    4b0e577bba05ec5cda5bc78c29c8b430

  • SHA1

    0b5e215668b81a0b6014ed504cd415b3a193c03d

  • SHA256

    5a705a3b6361becbf721b97ce9d56c870dd5492c114d8b1c27378802f88eeab1

  • SHA512

    449450d06cf20c773d99a0f2bb87a1ec45212378cc6692632e997474c2f488537b68fdac3c89eba4b658675eff3600a954bff72586da37167f0cfb829dd37d55

  • SSDEEP

    3072:MMrRcAV7RvOT1Y2QJj5rnxJwrlcjKhrwWb:P6AFRmxYFJxgZcjPq

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2