Extracted

• • Target

    47ad4fca26b51985a3655622754682736e5aae7b877fbc2dad5568a23a7beee5N.exe

  • Size

    120KB

  • MD5

    50692d16ffbce75004e7354a2e92f1f0

  • SHA1

    e252cebc0777beef504172de5e68801e3ea39219

  • SHA256

    47ad4fca26b51985a3655622754682736e5aae7b877fbc2dad5568a23a7beee5

  • SHA512

    e5cb45c8b0d341f68f45833e1dc1e89e6be5b18ed69d653742b90995b2231f397b722c0ff19e95b9c7b8a8bf1b355dca8c2682018ad670bcd1a99627d26e5b48

  • SSDEEP

    3072:YDe4UCBe3rI6k7qTlkXdkGMvpu7QYK94umeL:v4UCBexk7iOXcvAqWumU

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2