Extracted

• • Target

    9a0f9300fa02939d62015513987fe2654dd459fecbd6f415cc2e560062e29ba0N.exe

  • Size

    120KB

  • MD5

    b92732863e9cacc0a465465c96aab3e0

  • SHA1

    fd52f1146f8caadfe969b5dffdefeaf5d879a9bd

  • SHA256

    9a0f9300fa02939d62015513987fe2654dd459fecbd6f415cc2e560062e29ba0

  • SHA512

    3c017e70018d8402f8253dc9ad31a59157c932b336db18e227b49ef51321b20ba35cc731534cee8af119d1c66bfe017ed92aeae19ab82452c90c5bd2dd9ec150

  • SSDEEP

    3072:SRNVJyy4a0n05O8O0k8zvyEOzRJBgfjDI9k+:SRfJx5nBk84gb

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2