Extracted

• • Target

    48d036ec1612ff7043329a7a2dec4dd1b001bd550d3ba784e407c313b1befefbN.exe

  • Size

    120KB

  • MD5

    b9166a2f49ef9dc3b361c2227f6701f0

  • SHA1

    f405e128b8d7344ac5516b93f9026686aa67c472

  • SHA256

    48d036ec1612ff7043329a7a2dec4dd1b001bd550d3ba784e407c313b1befefb

  • SHA512

    3b959702b84d25d530221b3cfc4214f11a7a4fc8edfb1586c406cd1f553cb2175d99a61517de2ce006032b7f6d13a2e821eaaf83751841c2f341265e528b1a43

  • SSDEEP

    3072:ay0SClTMchxP+BLGyvG9aEx082P4HD6INT:aFpz+fvIav82wHuI

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2