Extracted

• • Target

    49aea3ba4c04d1dd1c4774e7800d6f89e6668119cde35c90e4f13da50b07dbe8N.exe

  • Size

    120KB

  • MD5

    3d22bc0d564f7213c176059fe3f64770

  • SHA1

    02bc3d4d6dc72736fc3841942e689c6c5edfc2bc

  • SHA256

    49aea3ba4c04d1dd1c4774e7800d6f89e6668119cde35c90e4f13da50b07dbe8

  • SHA512

    1893ed0ceabffdad907803716919f6ea218a06032300e8f25c2d2f08c98e2f1407f7f21c081f592b3da1f3560a15da8ca1dd57a87c7f85c38944e47e719f7fd5

  • SSDEEP

    3072:QsJpwB1TL+LjFIlAcAFRNN2e6USUhc/2QR:p+LqemzFRD2VUfhc+

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2