Extracted

• • Target

    ff1742c3a1d52c3fdf89e505653fef2ff8dad0cd2f8dd8fb4541bc2abd354d6fN.exe

  • Size

    65KB

  • MD5

    5f577309d30ff794c779b4482b573330

  • SHA1

    d1100fbda730bbf5443d53b70d205e33ab8fce6a

  • SHA256

    ff1742c3a1d52c3fdf89e505653fef2ff8dad0cd2f8dd8fb4541bc2abd354d6f

  • SHA512

    4bf84e6ec001570d7137cebf128a6f9327109895b121e613d105201e2229481f5a801a9a8246ce414cab36db4d1c7a11400828dc2e4154a09b4bdb45bfd0b3fe

  • SSDEEP

    1536:CIJZOJTQeVE4wgAxB6UtLwDQ5jFmzRrn2frnJDPnU4/z6:C7JvVE4ExsUtyQ90zRrn8nJ7w

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2