Extracted

• • Target

    e3703c4ea0c5906665a46d43e8d8d7c09106d53393f02a5330e4f4211b2df80bN.exe

  • Size

    120KB

  • MD5

    00b628ec80b33f346dacfaa2ecc21e30

  • SHA1

    c12ad8f300b37a4cec5e5839d633582235f2536a

  • SHA256

    e3703c4ea0c5906665a46d43e8d8d7c09106d53393f02a5330e4f4211b2df80b

  • SHA512

    636eb0d05d2a843bb52cb3b80238a9e6f899c845ea81535152bc3a8f108f299104b8083b7f742a4ab732a3d7db0c3361a44bcbfc9a4892fa893b76d99dc1ca23

  • SSDEEP

    1536:uHOfwJRgjkPq34A8nK51Wnz+SLX0SOX9ZHNntILhElM2h3xLW2or+EvvnplH:4OUdq315cnz+SLX0r3zuhEnh3U2JEv

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2