Extracted

• • Target

    59020c58fd7e2fbf65fef7c1796582e051958aea79da60ddcf3caa01de3e3f81N.exe

  • Size

    120KB

  • MD5

    5a6024cbb358ed82acaf01b788225f90

  • SHA1

    8d883c5f0284544a31c2f82acb096aed8d492e4c

  • SHA256

    59020c58fd7e2fbf65fef7c1796582e051958aea79da60ddcf3caa01de3e3f81

  • SHA512

    9ca3e929287cab0a06755af1c74ba3c00fc5eaf8fe0703a587ea74cf5fd67cf190ec910a9e813c944adc16fb51251045d027108abb05ff5bc6439025796ad5d7

  • SSDEEP

    3072:1LDuMWpx2HF3KhamXlfZrrYqVHst4pw5BZ2mo/9g4md:1mzpxyaf1fxYaHst4pw5Ro/9s

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2