Extracted

• • Target

    fad0ec86598c59e9540491696db970b0134a54f7509181e679f37347757ab683N.exe

  • Size

    120KB

  • MD5

    7879ea90c74c61049439135607bdddf0

  • SHA1

    0904693e566d3214c70a45b687f283e54cff5faf

  • SHA256

    fad0ec86598c59e9540491696db970b0134a54f7509181e679f37347757ab683

  • SHA512

    98e2582d51df0da5e345260a487f64a941c40469d4cab8210e0d48520579027e03cc005d8a14b8c738f993cd5cc50035b12601aee5e12eee0711cc26568939e2

  • SSDEEP

    1536:cx9sbI8gPN/ON9rNZ9gQIn/NrF/uc6zFuAHK4JTFOvQQRhvIOSW0iYsaPVa1/xpS:cnssPZOz9gDn/ec+/JQvQQRViVuuMeR

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2