Extracted

• • Target

    c726e3ee318be3636e5511d0d72d2d7ace027ab30c20339fe2589bcc4e6dd96eN.exe

  • Size

    120KB

  • MD5

    f72865490e0c4693c9ee06fdc9e78ef0

  • SHA1

    072715e1b4142309a2f7657ac91ccccab9a36f38

  • SHA256

    c726e3ee318be3636e5511d0d72d2d7ace027ab30c20339fe2589bcc4e6dd96e

  • SHA512

    f2ae6d9a75895fd6c2fa2c2530247024317281de045a28fb2750b71ddbf59678d3dff5f7daaa4c67d75dabe7a6534b7656b59327a1ff08d9d631cfd807dff585

  • SSDEEP

    1536:J0n1G81WSBr66kw2R+4xjj6CmiA8O1++QVaayP9AmlGtilMa/CCzvfaLg6:JSGKBBPk19kYSXlV/BrfaLg

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2