Extracted

• • Target

    e4aeb46a782a7a90f0b5566fdba9347ece3889352b2cbdec7dda566a51ac8912N.exe

  • Size

    120KB

  • MD5

    e3789691563a728e72817554015ae440

  • SHA1

    c83352573feddfccb4be34dcc40e278b57ea8313

  • SHA256

    e4aeb46a782a7a90f0b5566fdba9347ece3889352b2cbdec7dda566a51ac8912

  • SHA512

    e1a7f62cf9a463590d8629e04e5cdf89127073654382680343fb46df0745f6da93b8acbebd3cee74e8ecb428b66e755ea2e264e1b2aa05afedc3347ab51ea78f

  • SSDEEP

    1536:pSH2SZIMP+TxasIAmynN05Q72tI08kdlZQLpoC/YJqvufo7SmqdtOHpFom6iu69U:pGYvxPIWnN0MYj1QuGSq22/qDOHgm6i

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2