Extracted

• • Target

    2243a24ed2d96cea914dffb98e1e0b6390048de3c387f1b1e0cdd9173018abd1N.exe

  • Size

    120KB

  • MD5

    783f3b6e278a2ca3bc985e5308f3df50

  • SHA1

    3acafded5a42e2fb1f26a766e7e50b37060a109b

  • SHA256

    2243a24ed2d96cea914dffb98e1e0b6390048de3c387f1b1e0cdd9173018abd1

  • SHA512

    2f77dabe44d11290fe1c7b585b76919e074b551ea542f3f2dafe9bcfcad509c42ef2d825135ecc3bba9147d1e021cf1407432264266a9e94cb93e3c5e84b1d87

  • SSDEEP

    3072:5AbkiqQwOX3jLq6yGHq6Z7ROX7qfN6k4:5AbplpW6ZHqo7oGfN6B

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2