Extracted

• • Target

    ab7e5cc0e8f78407851e541a70f43a7f8b92644c0ca6775d1324a9fac7a13702N.exe

  • Size

    65KB

  • MD5

    3011c67736b1bc5ca5302117f38a17d0

  • SHA1

    01274d7fbd8ab57ebece33cd2104fcfe539d9509

  • SHA256

    ab7e5cc0e8f78407851e541a70f43a7f8b92644c0ca6775d1324a9fac7a13702

  • SHA512

    c5ff84a0ce7edc014ac991e2aaedcdbd644759522a1b99aca0532ca8d81eca5cca68cab2192210bb2e2e25dbfc08558995e8043239c5353ecab1b1fad80afab8

  • SSDEEP

    1536:zWgssocSG1CbnYUlXnHJookKehOyU8jblnS8/MkHjcVBPvr:z+sofG1Czxl3hEOlk1S8zj8Pvr

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2