Extracted

• • Target

    1396e434ab54c2abed881d42bdc937b109cbcc1ee41e72daf4b797288ac687d2N.exe

  • Size

    120KB

  • MD5

    d151334fccf5c0e6377315092b312520

  • SHA1

    40bf2abe83422b09a2568ab23ee44f05da015f6d

  • SHA256

    1396e434ab54c2abed881d42bdc937b109cbcc1ee41e72daf4b797288ac687d2

  • SHA512

    4fb55ad56eec888921456fbf4c422d86c55d5667012fc4fd8e0b08c1f40d4ec4cf4cf4bbd674bceafd0df88f493c803cce91f2106bc2d9471290b7e758d35634

  • SSDEEP

    1536:e2hDLqYtgmMemiIdy1Ri+fctRUs27DSZCTJDPsb0Ta/HvlUFfSvgNfpxu1qBNEB6:eGVUjSi+fM27uZAyrHvlUFfeg0kNEB6

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2