Extracted

• • Target

    985b71fd79a11777d694c975b763fac7ecd6ec1c6cfbbddf4d5137dd8c986a86N.exe

  • Size

    120KB

  • MD5

    79e2cd9244974182d1b2d1e8a06b3660

  • SHA1

    d384d2bc0a36513c0f66aa3d1e61a7448e259db2

  • SHA256

    985b71fd79a11777d694c975b763fac7ecd6ec1c6cfbbddf4d5137dd8c986a86

  • SHA512

    d8042dc1503c834b5f8f3c75993136aac53345ab5b37f71fb900d27b28b3ec96f858dc2af9868825f760b0d18a8ef0afdaae0e5d78a21c5547f391205e8dae90

  • SSDEEP

    3072:RLuyL6Jn12tJB3ZaAs0R6Rc+1WDT0C/3l0Huj6Av7:RLuG6JeBpO0RJTF/10Hu+M

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2