Extracted

• • Target

    3361fd892cf06af1e3637de2ce648e4e16b63e9dfe0a09c7a7e662f7cd16a451N.exe

  • Size

    120KB

  • MD5

    fe6bbb5f85656ad1950ebb48f8741850

  • SHA1

    5f3cb0db6bfe7540619529dd6d5a46196f17fe60

  • SHA256

    3361fd892cf06af1e3637de2ce648e4e16b63e9dfe0a09c7a7e662f7cd16a451

  • SHA512

    63277cd3d889458646ad7d493a1fb93dcb68c5f102a47c4116ec629761c2cde25c7fcc1148148b1de6558110b21fc715b510594339f0efa3ee97770122225853

  • SSDEEP

    1536:vZDGkT7gCWeMEr+T/cH5FayktsSv3P9RydafYcqq2MrokM6a846eLGqDOM:JGkRPMESbwFDSX9oMfYnkrXeyqDOM

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2