Extracted

• • Target

    1eac8d333da2e2de916253b25078ecc0a79bf9819c9a0cca21ecf615c6c454a3N.exe

  • Size

    120KB

  • MD5

    1d356ab5d729bec47351320b6661ad00

  • SHA1

    cf50311985d4ab03a4da5dd626d35f7a283ee6e0

  • SHA256

    1eac8d333da2e2de916253b25078ecc0a79bf9819c9a0cca21ecf615c6c454a3

  • SHA512

    b92a6b0d2d238b2b6917d358b74af412e658f35002bbb7d9b656abf9e7e87b0d97675d4acbbe8fd962c75df5de4a39312f1208464f6bba3c536d35c2bde3b55e

  • SSDEEP

    3072:jN8B9Ml2INlodf2315yhDnGEUGujAXP8WEKP0X5J:z2INOdfgyhDnGdGujHfF5

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2