Extracted

• • Target

    1d936f496a28a2e3406aff52f325871ac5da02b3d3db15847fe3f862348f22bbN.exe

  • Size

    120KB

  • MD5

    b24d4cd001a1d7a5f5f44e1ec616ef70

  • SHA1

    a21d29c215f9335f2d4ee8a02988abd78e66edab

  • SHA256

    1d936f496a28a2e3406aff52f325871ac5da02b3d3db15847fe3f862348f22bb

  • SHA512

    ed198ab6993ee6fbfccbf99eaf8ffb6673cd41d417974a7ee6202db2df14d21252b9e06cb6bb44b52c64892af3e47dd466e5945abbdbdf25fef5c378ef419ff0

  • SSDEEP

    3072:/1k63SvU/BQ4+0hnNVSXprxee1vY+/Thna:/1k6iKv/PIXPeovYaa

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2