Extracted

• • Target

    e48d0bae80bc4ff6af31c9037a2937f64e2d45aa07dc17263d38ba18b6e93618N.exe

  • Size

    120KB

  • MD5

    957601a4a2ba6e5f0ab03298ed1ae0c0

  • SHA1

    bbdfcd0e79db76bef4cf0866827aaa911afa3e40

  • SHA256

    e48d0bae80bc4ff6af31c9037a2937f64e2d45aa07dc17263d38ba18b6e93618

  • SHA512

    92c9fbb1ebed47ccca04450ffaf0b744aef55c9acc95622afd479777f4bf6c87e308b0b587765c1cea51202738a39a4c2b913078902b4e83501ff7f66e52b93f

  • SSDEEP

    1536:x3Y5OdlsWrwDQ2V+bwtSYx6kRsQqQjm4bIrZ+nIItiHug2xeGjPRcTHCClb+:+5/WkJ+bzE6kUIm4bAknDiAx3Vxx

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2