Extracted

• • Target

    614e98029802ceba2d462c2e7e758d6c25b1964ff9683fbe9697de44d4600e9dN.exe

  • Size

    120KB

  • MD5

    4d89f9ea88b5a558544e29c09f1f8f20

  • SHA1

    789f802cbae940ac5fdbda697e567ab8b1b5e60c

  • SHA256

    614e98029802ceba2d462c2e7e758d6c25b1964ff9683fbe9697de44d4600e9d

  • SHA512

    c8c9d5b30b4379ac110ca1d6dc127b929a9a7a7efcc63790aad04414ba6236e9200a538051d2b824b5ff97028f40e333dff623d29820aec8e77b55d74238eb59

  • SSDEEP

    1536:mdKUsE9OPPHiRczfYT350zRFIxMzz2V7kf+vi6zOiVQvUKn0xXTMr+G6Jj5IKy:mcUNO3HeTpTM3vn6zWmXTMrxqy

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2