Extracted

• • Target

    4e6913024ceb372e1a928a2c7917f6014433d35f0e75978b13c50520b9aaaf72N.exe

  • Size

    120KB

  • MD5

    5fd7a9f48ead5e94184d048557d03900

  • SHA1

    68ee3838f653072910e276ae2335cceccf0a657b

  • SHA256

    4e6913024ceb372e1a928a2c7917f6014433d35f0e75978b13c50520b9aaaf72

  • SHA512

    6e129a192fa9f572cb18f42ca8a65f9e2295943f07333e407040b8e7ecddb23fc9ec2c3336f5f1dd67f92b74b5bcc6b15c7380b05f58e84e36040c25a289bf55

  • SSDEEP

    1536:9eDocgkg2tbq0aSN20HRxZwZ9NseBvbg7LrXMLKBhhRMe+Q7LeG8yn225vO3o:9trIaOlxgjNDBvbg7XXMLQWQ/hDlO

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2