Extracted

• • Target

    d56a484f0649046f52782b7b43c7b488ebf19f9fb3c241bb2be4b98889c05246N.exe

  • Size

    120KB

  • MD5

    b928344ea666338eed019ba95b2ac740

  • SHA1

    df4a303be4b4fbc362ebd0eb68f3b00bd3df0afe

  • SHA256

    d56a484f0649046f52782b7b43c7b488ebf19f9fb3c241bb2be4b98889c05246

  • SHA512

    60ec9b5071f49703bec91a308347c160e02094da6de0aefdfd77d31659facaed12fd0c5efe6e03822da823f158eabeedbee1b6d80598ffca9d4a46c33e7d74b9

  • SSDEEP

    3072:taGnIp5u97Rf0AhWCyPqlyDjptFxRboZla/MxBGMU:ta0IEiAaKyf/RbP/M

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2