Extracted

• • Target

    554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2N.exe

  • Size

    120KB

  • MD5

    276d51898c915f96f3fb629416a89cb0

  • SHA1

    62f7c9c06bd037e4f210697c1cff9f4a56805149

  • SHA256

    554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2

  • SHA512

    aba56f58ed2d07fde536a1c038951f1bf2e795278d97c1601b709674ba68ef8e4a8c445f690ff2a50844a52ac84b949a97b814404f7cfed4f98aa1a2f643c4ba

  • SSDEEP

    3072:Irpb10i9FjcF4QJ5JRrhvbdCndvXyi+TwoHAMnmPWj:exuwHeJRrhTlTHH5Nj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2