Extracted

• • Target

    dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740N.exe

  • Size

    120KB

  • MD5

    ef592a3b9b69390316239bf5d8f11df0

  • SHA1

    ae504a1dc3cb39ca5bb8701384dd160f1e7e852f

  • SHA256

    dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740

  • SHA512

    0167362e1db5e6ea2f1b12116a99cc96fdd13824616836f7346d77ea6c34d547f6922797298fa45deb14e2191d0d0250fc01c5edf3439fbc69dfd95de723be78

  • SSDEEP

    1536:BHJPA12494n6e7Gt4nZvIbl9g+9SeJglqe3w52SBfLyMBzp8y0Tj9EEAo:BZuvWGt4Ib/hMAiqM4Bf2W3do

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2