Extracted

• • Target

    6bbf1bff8c2dd8396f4b3cd96993ed75ff7a9640a5a552fcd7db08314e0ac7b6N.exe

  • Size

    120KB

  • MD5

    52aba742b42a8b2c3f38d76c75a6e280

  • SHA1

    278b6b7fee8401e18d69e5816a8784fd242b1ecc

  • SHA256

    6bbf1bff8c2dd8396f4b3cd96993ed75ff7a9640a5a552fcd7db08314e0ac7b6

  • SHA512

    3c4bb4e88403c09d7f85e30382ed48deff46256883660836e1f9e69910fd41d435402c9435779147c90d8bf868d5a18697bedec6adb2349999059023654b5380

  • SSDEEP

    1536:2SVfsO/hVnR+EdiEIjy7W36Sx9tCxOCOwEdq+/mQSaY4tPjB9WGAq+868emufnNQ:ZzbR+EZH7c6S8Cq+OlB4tPdMGU8Y+2m

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2