Extracted

• • Target

    069f00db41fe4d81e2992bcaa08b7131c26005d2441135dd3b61b044b30bc890N.exe

  • Size

    120KB

  • MD5

    0feafbefeb9fcc239e94afd7577c78b0

  • SHA1

    927fbc8b7cdf33d5abeb17926d95e253f4ae2083

  • SHA256

    069f00db41fe4d81e2992bcaa08b7131c26005d2441135dd3b61b044b30bc890

  • SHA512

    d970b2423c09ae110f45cbe764a692f930bcc6cc252cbc26d3121d3d75dcd786859e73e8ac80e690dc82cd5b5d61047d3dd76324fdfcdfb8f97e4b484bdc2974

  • SSDEEP

    3072:wSx31w4O7Z18sddQDlY/qXacomEviRRi:wiFwJCsdd6l2qsj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2