Extracted

• • Target

    1101d9ffb78fc70ac75a5eb86e5b7dbb92df55c074c028b4c8d6456b07143f41N.exe

  • Size

    120KB

  • MD5

    169d66376c276ac8cc57a3ec0723f520

  • SHA1

    6cb46eb0ef654eb09baa3917f223fe55ac7fd4c3

  • SHA256

    1101d9ffb78fc70ac75a5eb86e5b7dbb92df55c074c028b4c8d6456b07143f41

  • SHA512

    52fc3e07e384f9f6ced64f11c6b6639dd8a9e3e91103733a92b6c2e31c8a73762948825ff26ac016e9ab048f48ecb940262ba0ef259429780929d5669afa9295

  • SSDEEP

    3072:8FE04SkySsJWmU6Jq0Fq3nIBQchrv5zecj11:8FkFvsJWmnmnIBQc3

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2