Extracted

• • Target

    1ba0b14bb4f0bb279164d473b897108251e0d6128447c48d7005b948846339b6N.exe

  • Size

    120KB

  • MD5

    80e0d158b42e48eece20ff1bdfe67da0

  • SHA1

    8e180a35599f7c31a15408e9c891646037e3563b

  • SHA256

    1ba0b14bb4f0bb279164d473b897108251e0d6128447c48d7005b948846339b6

  • SHA512

    79b31b33203ec8861384fb09ccc0e7cb5dd2db003930fa0992a983e8c3f6c124f79372da266593d2f7a20a1be09f1868f9fb6c4a5d523dbf8e12a3f760996795

  • SSDEEP

    1536:4RbFheFGVax37zNxA9Eobg04n/bQ6PS/ZVY/o7S5PEGIx5DKf2hCHLSG3D7Ydxbj:4ReUV2PATubQbY/5cJTDR3FXCtJ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2