Extracted

• • Target

    80bf17ea5e1317c79c77bdd29497b5fb9cefb491b8925d5fc3510b9e6ef43cd6N.exe

  • Size

    120KB

  • MD5

    fec24fa3a4800a7f22475dc19ff524a0

  • SHA1

    5661f8c529a7d5ea06a0faa30e8d610a11e32230

  • SHA256

    80bf17ea5e1317c79c77bdd29497b5fb9cefb491b8925d5fc3510b9e6ef43cd6

  • SHA512

    4eb4f8e906213b847a98cb50b40a254f5fef54d3191f3a63f343738aabe5eb870cc42000fdd3ccee064ec2abdb1cb926f83810338e63a7e4572ee2a239b5de95

  • SSDEEP

    3072:rb7RgBj5eTiKqmI42hjVc3r7aDqYeKtV+j2MNJ:rfUEOdmMtVKr1YeSVdMN

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2