Extracted

• • Target

    cf32a968a28b761c8b2f3d303bf7ad4f038e8bc669bfae4e3a174ec06ad6ff67N.exe

  • Size

    120KB

  • MD5

    d15ac88644863bfe17b9945ece35b050

  • SHA1

    4a11d087e00b66143f021f50e5f411020b6d033f

  • SHA256

    cf32a968a28b761c8b2f3d303bf7ad4f038e8bc669bfae4e3a174ec06ad6ff67

  • SHA512

    033507ccc4424d54c15150090a666b8cfbcac3becab1470a94a5b23df55719f8a4c49249f547ec5e5fa0bfe104af0c1be5bef4126c18f518100f231323c079c7

  • SSDEEP

    3072:tklc/+1mesGUqifJVUgF1R9+6lMBQNXN:9/ROgUgSG

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2