Extracted

• • Target

    e96da67d9a19f5d0e91c6b518f8a199be7975472ce5e9864069bcc998f1c339cN.exe

  • Size

    120KB

  • MD5

    bf807a8cc20bdabba515204ded550ad0

  • SHA1

    708b9e3df579c5204d03a8be538fd0d9ad2ce3a1

  • SHA256

    e96da67d9a19f5d0e91c6b518f8a199be7975472ce5e9864069bcc998f1c339c

  • SHA512

    af0471279d01a6ed39cba2453d068279f87a2111f8b7fc292341bea538c30065771aab74ea2c20f8c2a3d7fdb139c5c998a35a450f895d515ff64f03539d37e5

  • SSDEEP

    1536:JzMPjom7t+62n/RL41uxOA9S4ss8VNj59OAqyGhib8l1jJDqULDeFclRODqWbK:JzSf7tNS5LkGIV9OACib8rJMilROeSK

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2