Extracted

• • Target

    de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757N.exe

  • Size

    120KB

  • MD5

    f087713cbf3a5cc44abb1b110f7ddbe0

  • SHA1

    a0d0ba4c5580a5ac80a2ce4cf54c21d8d3674066

  • SHA256

    de7e77a3ff2cf4897177c46aa284f50644671e58d0e1793b487854dd34e60757

  • SHA512

    81860ba0c8db998582b1009d914e337c28b540d6e16b13d3c198cb558b8fcbde9e15ec14485f36fa88531d5871fdc0280fd7ff06ef0507178503480644a60316

  • SSDEEP

    1536:NsvKA0c9wqGmXVGt0hKfaxVccXM4a7CdZnl1hzDOihkFoqumiV+vJ2//jhjSC:kR5hGmX+L8Vc97mlfGimFtuz+BaFF

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2