Extracted

• • Target

    0fd52308b6159940aba52b05e6a306f6307c0a4322ab311167e3343cc012f11cN.exe

  • Size

    120KB

  • MD5

    0762a42a6bdd5d289af5c2e4aaecec50

  • SHA1

    d0502fe7ffa972c8706cc80f88dc858963c38009

  • SHA256

    0fd52308b6159940aba52b05e6a306f6307c0a4322ab311167e3343cc012f11c

  • SHA512

    5155e316b2ef77e3fff9cf19564ff42d23552dfb58d309075e7555b99ced1cd336a94dd727f9b8a57efadec3e92ecea6eb3ed2a0c8bd17747f585222f2d28b14

  • SSDEEP

    3072:X+aC68Nw2LtLG7jFi7CYaEgpuYHYmVmL:JCmSlG7jFi76puYH

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2