Extracted

• • Target

    d479cfa5b9d8d4ecc82c3e6c803303fb57f31f223314bd5028a712617c73ea67N.exe

  • Size

    120KB

  • MD5

    a59d8ef35d9cd3b908ebb126e7427f80

  • SHA1

    c6fd9d8e92084fc3e6b19b1938ace765904d2fff

  • SHA256

    d479cfa5b9d8d4ecc82c3e6c803303fb57f31f223314bd5028a712617c73ea67

  • SHA512

    9686f34d49a9405293f30a9228daab787d913966d41719ec1858796fa0fd846445c337cef257ce7b65d0cdf04da4c38bb44d4941dea52a874431a6d1b4a91ce9

  • SSDEEP

    3072:GBrZeL5yAmxOB3vFlvkM5l2A2Takz9cchC8RPCgrxHd:GBwsA3PdkM3e3RPVx9

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2