Extracted

• • Target

    75de1d036390046c10747a619cd88fac475dee020fb637fe1ac3b23cbf04782bN.exe

  • Size

    120KB

  • MD5

    e9d018983175d806a08dcece2a272640

  • SHA1

    185c56664963c3c544bc0cc13192d28aa45addb7

  • SHA256

    75de1d036390046c10747a619cd88fac475dee020fb637fe1ac3b23cbf04782b

  • SHA512

    ff2315a781276505ec4f6c51bc32e06c9499358ed0455b7f87b36221faa9f654dea02b31f2d45a4666ae51b4bb0e1c8615f09bad51680b99079c33729bb2e6ef

  • SSDEEP

    3072:dcK/3E5esCxHCG4TjiD55fEqPBZV432iuJ83zPW7SU:dcK/geRpcS5usXV02n83LtU

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2