Extracted

• • Target

    cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2fN.exe

  • Size

    120KB

  • MD5

    a00809ab93a1d5c249df250cfb57bd20

  • SHA1

    79b1508b35d7de48ff64476d7bf7d4e4ca66cdb6

  • SHA256

    cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2f

  • SHA512

    231fc1f12cbc8cfca2cc74f972576a77c3c8d6b546c9560ae3e0625e3a70a235bb4cc45b35cb1c97b05fe53ab18e6210271ecaa737acf3c638d7010560c16ceb

  • SSDEEP

    3072:CjC8+52JfyUtXx/DlJ6hDLCnzTr667fDd72BS:ClLZ7ZJ6hDunnrr7fDB2

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2