Extracted

• • Target

    39cf19a4b6a90c22a8921abd736dcdd093d56a1f44e5d464c261b9d91ca75e7dN.exe

  • Size

    120KB

  • MD5

    d6e28fd7baf7a84270a1bbbd406a26c0

  • SHA1

    a4ec46c06a7912dc6ade2f59ce1ea6d7b68f780a

  • SHA256

    39cf19a4b6a90c22a8921abd736dcdd093d56a1f44e5d464c261b9d91ca75e7d

  • SHA512

    c0a4e7b0d6d7e725400a7d89780add0c5a1cd23a3b750edd563c913726eadf4a433192be09eddb56b6762850d9d03a0ec3c6453667688f75e29af86856cf67df

  • SSDEEP

    3072:qlpjdxx5DknV3DWorKfnXpt8+nM4XD+kR:qXngnTrW5t8OBTxR

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2