Extracted

• • Target

    420d1325486da657a7179f6ec6fd7522a444b82bf5381d3837ad06f4462addddN.exe

  • Size

    120KB

  • MD5

    13a2ffb83b53ac74d0f814cc46654fd0

  • SHA1

    32ce5462ef6d57d7061992e974c27e3a213dbe7f

  • SHA256

    420d1325486da657a7179f6ec6fd7522a444b82bf5381d3837ad06f4462adddd

  • SHA512

    35e09d0b912bd87c1c4be8573af31302f29c242460e7e870138d61efdd891f7d0a3f5c36268944bd76b568da8a9bad480a39299eabf6612b3734817e4a480268

  • SSDEEP

    1536:kl6P4N51ykto3XvzGbUgXVthzcRDeKd1EGiziHIeuYNIfTkfipm:vdkQfzGYgXVthcKMStz82KIvpm

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2