Extracted

• • Target

    ceef912bd51a33e4659570652c8dd56f911a026d66baa177277c62a055116814N.exe

  • Size

    120KB

  • MD5

    f23de772679b8c1c722f9ed984c93bc0

  • SHA1

    1f0963be67b0a89ff94bb6e7422602a43a7cb0ea

  • SHA256

    ceef912bd51a33e4659570652c8dd56f911a026d66baa177277c62a055116814

  • SHA512

    a26eb47912aea4591870193411e2eb0ea2b906211910b68a475714ab2ebb3df61d0026748769ef6e95af7444e180da91991e44316dc4c28656bf3afda29515ab

  • SSDEEP

    1536:Wx3JhohEf7DPl8wPrlKif5+4ZCB5KPJnMWQ6tNqgdzWRp1MkZjpqeE1fJYM:Q5ZfPPl8MZKCZCyPJn1XfgpVW

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2