Extracted

• • Target

    259f1b22fd1e535213f8d1475c67f528e0754aa05d2d10a7b8a4b52e275facf8N.exe

  • Size

    120KB

  • MD5

    5f5aff8de399d1c5d64022e95b704f80

  • SHA1

    fc65e7a5e19dc66559319d555b0ba0034cf18b66

  • SHA256

    259f1b22fd1e535213f8d1475c67f528e0754aa05d2d10a7b8a4b52e275facf8

  • SHA512

    b572f28e2f16bbaa4c098dab377c404ac9d1ba23b28ef6c1296a5d78683ec0023389d32f15ced76f21311936fcdb9e77eb18252fae1970c3a90aa2e9ad1bca3f

  • SSDEEP

    3072:VkhYKY/qKHgSL5njZrGNkC5pwKHTy+ckztD7cosp:7K6qgV5jZrOllH9RztD7s

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2