Extracted

• • Target

    03e48a7a275ccb3b5a42810f9b60c9edc82d94a3128e1e67cd5fff2dd1b2e20dN.exe

  • Size

    3.2MB

  • MD5

    40fda6a9c273dfd6078cf873b454bd90

  • SHA1

    3a70516e41b4b654ea5058cf8792f56d18805aec

  • SHA256

    03e48a7a275ccb3b5a42810f9b60c9edc82d94a3128e1e67cd5fff2dd1b2e20d

  • SHA512

    0c1d3ed893f005e07dc9edec2a1a32fc72b4ae32e1ed320d5b647406fb21e0c36b545120909fa0398d8ee29f9548d19919fae95f011feb4a0af1b27734ce5e90

  • SSDEEP

    98304:ou3lbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:V3BxBxCLS3xZCsFyBzxcE6pAGbq

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2