Extracted

• • Target

    df92a92425260e9c28009a76bc2a9cc9ab812c92771131f0243e2f3824553ea7N.exe

  • Size

    120KB

  • MD5

    88f29dfb98f1b3871c2e2becd5bc2870

  • SHA1

    f3aeb0a8c7ec723710f8c90bf4a0f99d8e4f8ff7

  • SHA256

    df92a92425260e9c28009a76bc2a9cc9ab812c92771131f0243e2f3824553ea7

  • SHA512

    430d1d2296bb3237ae4ac3fadcfef7744a5545f9cf37846d378c3613e8c078cc7935df034d6ece5cab134fe3682e5f34a24f9a1db166e55224cc17c9f064a682

  • SSDEEP

    1536:XAbzO76H7DNgZMpmt1MNPdZNhixGFzWLzLxrdxXGEFUm/imVgteWYqMZ7U:gpH7DNrIfMVdHhhFwPxvXGPmVgeZH

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2