Extracted

• • Target

    0e821a2d1a38983eca037a4a4d96c70f805b3b8845e9400cf6839a976479ff83N.exe

  • Size

    120KB

  • MD5

    eacd25bc983f3ffca4ddf5d300bf9420

  • SHA1

    8145a9cb4631a41ed09b726949cf77fc5c95b9c6

  • SHA256

    0e821a2d1a38983eca037a4a4d96c70f805b3b8845e9400cf6839a976479ff83

  • SHA512

    bd728c41cbb41bf83452cf01b16bb8651b88a469cde36ab5e6b1946bb2aedcccc0cf00be9076f71f50e7270aa8362910435675c0bee4ae3bebdddc1d759f2407

  • SSDEEP

    3072:x/c6nQ9HDcmG5ISVRw0VlZWFvYV1nAWs:dHqcXtRrVlyYVWj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2