Extracted

• • Target

    04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1efN.exe

  • Size

    120KB

  • MD5

    1b056da8def36eb3af393fe88e789410

  • SHA1

    df6f82ff17d8413f8c07564ba40db7ade7ede1fe

  • SHA256

    04005dd1eee254aaa893ac325852a306b26175dd0772b0e46a4b69327514d1ef

  • SHA512

    b48c4b8b842de3228ac471c26559b543c7b066aab72c6dfd79b5e43d97ccfa9858f8dce1dd87ce5460d82bcc916637005b9e69590ad0c2b656a21462cdd872ac

  • SSDEEP

    1536:Br/mAVUTSZTa5KANWMS6/s2/lQ52D+fuwfLIHulCroZTMOWysHFFmjaM3:BTbmYiWT6/pG8OwUZTMOWyokaM3

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2