Extracted

• • Target

    ba69dcf3d16a5073f337793f87f11ad8c6512da7edac33bb6f4216d6c1c3fc9aN.exe

  • Size

    120KB

  • MD5

    f3343ec7567bb798e6168f380a6cca70

  • SHA1

    03e1a2f2f9ddffb33f0a5fe0d9822b508157674a

  • SHA256

    ba69dcf3d16a5073f337793f87f11ad8c6512da7edac33bb6f4216d6c1c3fc9a

  • SHA512

    221e7366c493fc924d10fb381cf6a9a6aff7d2245af85e0d2e082869eb0b5f7f871318444215302e0b5c5fa62d3540836f73e3d636a8c5b948a00a337f777a19

  • SSDEEP

    3072:mrzjmn2XzoaVBe7eyEa4EahUy00Nvlv5q:mrzjmn2Xo+Z300NB5

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2