Extracted

• • Target

    6eb0923b633d484a45553c2ca3f13287dd5b0d81e12f5291d6b4f2a5cbb97247N.exe

  • Size

    120KB

  • MD5

    85fdf4527f7724b32b5e83688a74d300

  • SHA1

    42d9a3d3e2704185f2fbfac2c19914b88841b931

  • SHA256

    6eb0923b633d484a45553c2ca3f13287dd5b0d81e12f5291d6b4f2a5cbb97247

  • SHA512

    b36b28835751f6dc25a96d1506c75d3d4a332789e76c6aad395f9314ffaef04f30f4ada75f979c31e715b9c57c52e71f957e506dbc79cf719dea9c80089534fd

  • SSDEEP

    1536:CuYTeVUU5qIhSBNt8xXyVxw6aGM+XTyNEDNTbiJ/oErnfJBNj/8JW6RoLeJR:CuuAHINaNyVm6g+Xo+VbiloErnBT6iY

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2