Extracted

• • Target

    4efe90e85b7caf19cb5c9054ec50685be3de5082f6120f9ac175a5f0784ea9d1N.exe

  • Size

    120KB

  • MD5

    5cf92e5ac76e365f0b43270c0732ea80

  • SHA1

    c8e482b68410af4c583268775402db923a44ff9c

  • SHA256

    4efe90e85b7caf19cb5c9054ec50685be3de5082f6120f9ac175a5f0784ea9d1

  • SHA512

    5e65e6d5ff334a3d24ccc0d2ad0740a689131c45f3a58a4756bcd25913c15b8ad70ee38193505a9e975380998d1b08761b7be50147c4a332b0c012e906a3dce1

  • SSDEEP

    1536:HP/feVYzxSQt64I4FiI52FAAl7jE+F6MhPrX7la8ZL+VfN5JbIjzlRWB/5EJUnxW:v+VO0q3MhPnla9tbws/5NnxwILI

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2