Extracted

• • Target

    33046d944ef5e45fc6d4c438f5e55d704c3a3c02f7e7c4e0e5812cecd1c31b87N.exe

  • Size

    120KB

  • MD5

    ca857c65c74be7586d428534ff8e2550

  • SHA1

    bfef2a4c283706975710dece2171879bdf206a7e

  • SHA256

    33046d944ef5e45fc6d4c438f5e55d704c3a3c02f7e7c4e0e5812cecd1c31b87

  • SHA512

    c2aca84c38905f0d1bd93b261fe71a41a5547a7881ed265f944df8c02c732416ffd5e098c7f88f7973eb4df5c906d36e6d71e144c8ad0c7fbcc95ff3d5e8d47b

  • SSDEEP

    3072:asaMi91/70x+Wv29dJ/Ql9DZeNe4pQLw:altyt28lDme4p4w

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2