Extracted

• • Target

    756a0f4a1c839abd066d4df4e89aa92cf07c96297aee8834e0d7cdc9d98c3c9aN.exe

  • Size

    120KB

  • MD5

    cc9a9f5d573906f545108d3cf3d28c40

  • SHA1

    fc6bff8cd54f5b5ab6df0b9d817313ad704496cd

  • SHA256

    756a0f4a1c839abd066d4df4e89aa92cf07c96297aee8834e0d7cdc9d98c3c9a

  • SHA512

    99c90ba5a3e785def929af13163f6a8d4abfe77eb51a22089e860e8ce397502f359cb74a29c909f433b6a5b1d656d32a4a484799522f482356edc24538262117

  • SSDEEP

    3072:xhxM7F4kEEmU1rhi0oMaJrQ1aOxsbw22ANTNazzDa:xs7Wfu11i0UJrQBx/22mazzW

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2