Extracted

• • Target

    3a4deb29bf619917118ddf0b110f105d2a332ba186f1c4bdb168d10718250d21N.exe

  • Size

    120KB

  • MD5

    1048c639dfd9314f1a9d52d1e2df1ff0

  • SHA1

    13351fa68e7434e10dd5981cc2e84ea7a123b1c8

  • SHA256

    3a4deb29bf619917118ddf0b110f105d2a332ba186f1c4bdb168d10718250d21

  • SHA512

    cbfc5ac25cc7221b447a1c076decfd1c0520f28b72f16057cc53eac7056fc0b68f335b31486b938a415870687bd092f37284fc0430b57b84c65ab344a03c840d

  • SSDEEP

    1536:Jz8+gCE1CsJalE6LsL+Mfy27remS1Yvg4AUtMRoiG8/efJdxIFUmqfV1wfmMB7W:F5gXoIl6LD9AwYA2yo2/wJ8SdN1uv

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2