Extracted

• • Target

    fd8329b8b65f2f72fc1561f8bfc61ac5c5f9b09345e8363ab1ed5165fa4ede2eN.exe

  • Size

    120KB

  • MD5

    434299655005ce8de6d6486d551aa1a0

  • SHA1

    6d0e691da598ec75df61a2ac4a65a101cd00fada

  • SHA256

    fd8329b8b65f2f72fc1561f8bfc61ac5c5f9b09345e8363ab1ed5165fa4ede2e

  • SHA512

    ab7b13eaa68d2bbb686c829bf8fddeb1cad61a89bc79f9e4f1aa54beea14600c9f1242f0d797ae490b83f9778657895fe32dbf21bcf8409c9f3a101aef52084d

  • SSDEEP

    1536:mOolqh//mx2ljgbbhLui5iIlF8Co75uFL9Dcm3e9ay75nn5/kucG/937dOdPY:mOWxN3hzoYV9DRgnnlkuco937d+Y

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2