Extracted

• • Target

    a8a02fc55694b31e5419e4ce2fb8378c8ca08eebcf3c027a951c16c3ca0a90bcN.exe

  • Size

    8.7MB

  • MD5

    76785c38b8b8f73f31669f8f8cfd9590

  • SHA1

    08112acb695f1750a6c0c89359c06a95db1ad0f0

  • SHA256

    a8a02fc55694b31e5419e4ce2fb8378c8ca08eebcf3c027a951c16c3ca0a90bc

  • SHA512

    b5c892891f18671892d73d831c6741960fc3c5da1e01b860c6d4997f288d660bd10af2d33eb464fdcdd76b0085ec7d6aafea2356fbf7e9af1306cc3f77448b67

  • SSDEEP

    196608:YuOLrHbhonFpnMau33bP4QbS4xdKsAhqfmrze+fvLSWmF1PDX0bwE:4r7K7May3bfbSE6qfmHPKFWH

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2