Extracted

• • Target

    bde8c63fda79e46c6bb46ecafd95915cca58542300996d13d489ee8cec695c7cN.exe

  • Size

    120KB

  • MD5

    7fa4b7bc05e28325c08371059aeb8c00

  • SHA1

    f7655ad4fc396a1391aa45a36b4013e97c41cb1c

  • SHA256

    bde8c63fda79e46c6bb46ecafd95915cca58542300996d13d489ee8cec695c7c

  • SHA512

    e77cf6bb0a26462ca659a04da3c59c4a9d9c1a981026073b8c847d6a32b7692394011d61a62e33ff556c04175eb0a0abf245154aa4c455b6441dbaa4f257bd84

  • SSDEEP

    1536:sPoPkj0tzzFGaerogrcNybFm0QBQEPyRaJ4z0F69No3qkkpxFDmmfO7XvtISs1RC:mCmYzzFTorcNQIBacJqR6kXkDXVEw

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2