Extracted

• • Target

    92de4d5d7efb58142cae663b976f015ea1c4fbfd990ec6e26cf1586fc28a76adN.exe

  • Size

    120KB

  • MD5

    dc867423b24ccd3d397dcae64fedb900

  • SHA1

    fea8a406933ef82a40a3f69b33d3a18e7f773b04

  • SHA256

    92de4d5d7efb58142cae663b976f015ea1c4fbfd990ec6e26cf1586fc28a76ad

  • SHA512

    620768524b5ba72205d8ca5159b568ec42a1bf34fae5dbf70a8528ef81c4a219aec4dea526de96db3a12461159be2a4bd465e3a29a291dadbf56cb510345cbae

  • SSDEEP

    3072:rhVihrNh3l/uOBUloF/iyCFSwTPFixJfeihh/Gb:rTIll/u+U0i7FFMJXhh

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2