Extracted

• • Target

    50e81915cf5a245cb214c0a15adf7ee4b9375c7f70098fce221ca1f455743c05N.exe

  • Size

    120KB

  • MD5

    eb213455d732d31800833bf0d44aa930

  • SHA1

    9b2f49900707aa129ba4fbd1bad1f503cbc47d12

  • SHA256

    50e81915cf5a245cb214c0a15adf7ee4b9375c7f70098fce221ca1f455743c05

  • SHA512

    0299d4f60d21987ecc9c21b421b7de104e432f69ee20b48190e1c2e8cf9e98a79cfd531360723fd0d0048e30284ab2a3b57f4b816ea3cb8a607065717a2676f6

  • SSDEEP

    3072:Q1+Qj5JrW9akqLzSnEedTbvllH79FQ0kOrHIvQ:AqQLzSEeRbvDHRFQ0k6

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2