Extracted

• • Target

    006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933cN.exe

  • Size

    120KB

  • MD5

    29ba3a8632df23709ffa81806af34dc0

  • SHA1

    9c88d9b48c08bf0a45dbde821e1fe22f9e6e8ae9

  • SHA256

    006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933c

  • SHA512

    eafedc574b5aa9cf36564aefa4c389e3bae2025f66445dc27414282c2144caf74816bbb88638051fa4db6bcc278751455b55628596b38d62ed3f588fe0f4cdb6

  • SSDEEP

    1536:B6+rRG6gWmiSBW1004mo9f2hro5gpvrphYMvBJti/Vjgpx9p6f:BtdDgRc1004pGro5uvr3Y6B6/ls4f

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2