Extracted

• • Target

    4e58732b0b2277f3732e78e421ecb821eff05091d84ff529b5d2b78c67b8b31dN.exe

  • Size

    120KB

  • MD5

    3b81149e0f499bf5c845cdc46caddc80

  • SHA1

    00fcc282e1583070448d47d291e765cf17f736a8

  • SHA256

    4e58732b0b2277f3732e78e421ecb821eff05091d84ff529b5d2b78c67b8b31d

  • SHA512

    af0c3e3496f4df2cc7af7a36bcf1249e536a7593e2e4c8b1318e431d3d6b64c7fd7577355eb3181c466657bfbc6f36336cf7eac8de7b816d998cc42a681e9d79

  • SSDEEP

    1536:RUJlldTN94kvJFbkmqcaXj5J8rf0vLFdWH7KEcpZxugyVkENh2/cISXwvGm:RUUAJ5qR8rIJdA7JIKkAhTjXQG

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2