Extracted

• • Target

    ea2d006cc6fabec5fa40f9d5f6625a8a4c34afb50b93b0d2e0c4046d38e20137N.exe

  • Size

    100KB

  • MD5

    ad02e6cb8eaddc2da622db3d59fe7800

  • SHA1

    5db1ef60d987c3284159fd3698e8f43f4acba0c4

  • SHA256

    ea2d006cc6fabec5fa40f9d5f6625a8a4c34afb50b93b0d2e0c4046d38e20137

  • SHA512

    67f69dceb932c428b2f42351b290271908a2f5eef4b8d2a2606893eee52974b8d37f2d1e53a77e95860ef41a46fde8e1d5f3c8a33df4b9dc232c53d480fc6202

  • SSDEEP

    3072:Dl5S6G+aXAQaJnHqnwnoWLswTnz7snGM:pLGTXE9KqoWLswLsnGM

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2