Extracted

• • Target

    9fdd9ec73f17e6f7c14c4acfce5e6aaa421bce33f0671a6dee1b994255bcc3e4N.exe

  • Size

    120KB

  • MD5

    6e5bf2550ca4b4899744667269d217a0

  • SHA1

    28112f5419ca8b1006dc64eed16571cc13b00bd9

  • SHA256

    9fdd9ec73f17e6f7c14c4acfce5e6aaa421bce33f0671a6dee1b994255bcc3e4

  • SHA512

    1e6b1d628bd59436659814700268f7bb26a5055da2026e5411fdb44c42948b71801b91b501e23ecc9a6da6ebb1e91e6f7aa000107917f6f2f5a3a3806622b06f

  • SSDEEP

    1536:agm6p1Fy3dxTqlP5zXb2HKBKe2NwN4XGNgaYrPLAjIhcw4hifQ5Bjx6U/6fTI4bD:/LwAdqHoKe2NwSXLP4Ihc52QzF8xNKK

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2