Extracted

• • Target

    a56969646b7a8744f0bef094e438ab1fec869d625cc29a3618df79d80acf4dbdN.exe

  • Size

    120KB

  • MD5

    3cbe82c3bfa943c58f8436e3e7e9e040

  • SHA1

    7cd5f20a29d730435f2fa848e275a319f7420921

  • SHA256

    a56969646b7a8744f0bef094e438ab1fec869d625cc29a3618df79d80acf4dbd

  • SHA512

    d5d43457a527700450b59de2b66ec6cf4ed2ec010ba6df9b7ab2686628f70f10615901dcaeb85f5425e67ab5061dcaa3d3e2ea9e5d9da887b2fd1f4c6ecc3b88

  • SSDEEP

    3072:Ml18ay96IKU0EWjJYFoYVupVLuY7wWSdSRhzj5H9CO5DAHPxQ:W1H1I/oFYOYMDwWSdSTn5dC5vxQ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2