Extracted

• • Target

    e0e0c720266d220e06b71da27584b5498a7f81a78f1a719c59e9dce39b1c4d1cN.exe

  • Size

    120KB

  • MD5

    8ace0d77c251b39a68cc37401b68f090

  • SHA1

    fe9d047029f151d623fdd429f5061f609289bcc6

  • SHA256

    e0e0c720266d220e06b71da27584b5498a7f81a78f1a719c59e9dce39b1c4d1c

  • SHA512

    bfd3e9536523f7fa2d39360ae90d02c3342742475eabafc5f4b4d0aba6de88e966051ad26ac09e97b729760aaf5dac206ed6da4661a14c04096dbf11aec3becc

  • SSDEEP

    1536:o7Z4VI2TAz8aRRGoVrI2x1q6sYBngcYCkPecOI/vFsKKHIOBxUaM3HJ5FEiSYkJV:oi8BcoVrNbqkpgP5KHD1eHJrEwkDL

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2