Extracted

• • Target

    1b8378c23abe91233a8b55f5586a5b6f7a4ff2a41d56c9e70680bfb6e0de4934N.exe

  • Size

    120KB

  • MD5

    2cf321993edf7e9b7c43f2fbe086d6b0

  • SHA1

    b87717e00243a1923d39812f6087891a894b550e

  • SHA256

    1b8378c23abe91233a8b55f5586a5b6f7a4ff2a41d56c9e70680bfb6e0de4934

  • SHA512

    7c655dedeac3b221a6450807b25f0ee677b78b6bd1ae9bb484e3abd5fbc6e8af3e6cd5782cba5c30b57d5dcaf2bcf19ac0e8d91882a791f7ee2b3da4bf288950

  • SSDEEP

    1536:es2ptxf/tJfHKhZ0j+BPjycIX9aJJeP/aVizLukSMM2KUaBzJoaY/DqN8S6sAuex:e3tV/vfiyj+0cIX9K+VSMM2jd08S4

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2