Extracted

• • Target

    d61b98f74e0e61dae249b43f96e21d5180fc6928843b00f76b60ed359209005bN.exe

  • Size

    120KB

  • MD5

    7a04228c03d0ba86950174f6838aefe0

  • SHA1

    3f9ba7ba6cdf4a854fd546bf8554709c70fe23b5

  • SHA256

    d61b98f74e0e61dae249b43f96e21d5180fc6928843b00f76b60ed359209005b

  • SHA512

    89f658aaca3e6c124aa130287a58227eb69a2c1c5937bd07c9c3b5d75cb169d872cc00b3acbb1ef1bb9343dac37d7fbe59414c9621ba7b3551ba07bc2250f80d

  • SSDEEP

    3072:BIi5/A0JczZBhgE312GON0z+dsTjLJdqfY:Wi5/A09E3MJCKdw36Y

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2