Extracted

• • Target

    3d81543ef2b0a6e5bfe2e665b77d6eb0dcb68b73c860860e7c96e8b1c6bab782N.exe

  • Size

    120KB

  • MD5

    e750c790a429d5b6d633463a7f9f01b0

  • SHA1

    61f8e5af8319efa643b400fc15bf3ca30adfc29e

  • SHA256

    3d81543ef2b0a6e5bfe2e665b77d6eb0dcb68b73c860860e7c96e8b1c6bab782

  • SHA512

    6c9437b9e186dcc2291a5283277825ff6539b430b66a95f700a698d7dd3fccd84b361e502ed32d5efbf9107a22c01f94d6ee1e16bdce3cce5fdb50b66d334d50

  • SSDEEP

    1536:Z/3RtNTihJ1yGXoC6yXTs2BrlLqgJxNTRuCCMsbhYn1frQY2R3KlxVPf4tIeGCxx:Z5tRIVjs2BrlLhLohIfswxSO89h

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2