Extracted

• • Target

    278274054426649988a238e8eb4515f07910ab131e0ed2d5091503218a158ee3N.exe

  • Size

    120KB

  • MD5

    e0ce2bdb63020f72e3d4c7c7d78aa630

  • SHA1

    8c1cdc47ec9e3d448a321f4e495ad5b5b194cd2f

  • SHA256

    278274054426649988a238e8eb4515f07910ab131e0ed2d5091503218a158ee3

  • SHA512

    6e53785d588c2884a53c51d36c3ce78dda1becb400dec1936bacaf6ebdfd5c53f7201ce5c7971d793a296d0941c0f65f4ac2b83940cea1fe274f9fa7c47564cb

  • SSDEEP

    3072:JmDKpVlBiFA56pTlQ2TAtg+sI5/XmezjT:JmDUVeFA4p5Q22+aXVzj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2