Extracted

• • Target

    55fc186ff1746373b2c42d684385360c4c86017035a512efcee6007924520c45N.exe

  • Size

    120KB

  • MD5

    4ebfe861cceefdbfa5135c53048df9c0

  • SHA1

    8825de5b8b34a7e6d409bcfd4d65648e392538dd

  • SHA256

    55fc186ff1746373b2c42d684385360c4c86017035a512efcee6007924520c45

  • SHA512

    22112c37cf22c748207b9ae1f0f5ed25af71a1fae9f4f5ad279424c05ee0d671e659281ed0334457c35d1567dc0df8511e1b7868bc08d0e23df97d0cf062c118

  • SSDEEP

    1536:4cnYeEBkSV0HPMpGaoVXqK+gOdSIwoiGbpQAPsa7Slkb8izjTP8Eqa6aNYlqc5e5:gNBoSGZpgghGbpQIsaelGJTP+IWJ5e

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2