Extracted

• • Target

    865d6c5734fc2e131c6fb75cb14a6b7167474b08300e21be56eb92be1a80aae2N.exe

  • Size

    120KB

  • MD5

    2e086ec779a1429d411c2694a6520e90

  • SHA1

    3e23dd66067a432d7fa53dec803010ec7f4ae211

  • SHA256

    865d6c5734fc2e131c6fb75cb14a6b7167474b08300e21be56eb92be1a80aae2

  • SHA512

    dd6830cf78fa55ac94fc7d11d54c28b96c46483fd5f2ff0bd3cae2ffe32c596bfd1a8da288790a019e07eb6d8be0d93d2b90657aa59e2736b89be060b82492f1

  • SSDEEP

    1536:cQaEvFtfCvdf8r/mH2CNFNPKgyWG4QhDPvPolIg8Hu8ouaO489iXuR/dTReK53Da:Aot6dUrenKjWQhDRg8O8MKiKdesYP

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2