Extracted

• • Target

    9529b02cb9adeff217c9a57cfe867b73056ade0efa54ead5bcca6294f118a9b5N.exe

  • Size

    120KB

  • MD5

    71978d951d9071e88cdc891fdb3ae0c0

  • SHA1

    7e1d89b724cd01c4a1b3f5a0783d435e8f63ccdf

  • SHA256

    9529b02cb9adeff217c9a57cfe867b73056ade0efa54ead5bcca6294f118a9b5

  • SHA512

    39aef2b5febd84c4f6c59454eaf119ef8c1789e4849d927a1f5f0913897d0f1a5ee714ec9b8e1c5c253904692224ae030036a531641a1aed8fb474df5aa28c07

  • SSDEEP

    3072:eewJuzPRfTMRMncuSjhsA0DkeD2XdL1P6J64:e1JujBIRMnJmOKe+VQ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2