Extracted

• • Target

    bcf598ddc301d322d584f77e8af0d743bcd5bf7dd88186f5848f5772e82d859aN.exe

  • Size

    120KB

  • MD5

    2487825a63e3c5794ccbd944e7696bc0

  • SHA1

    1e289585de2a403e8bbe28ed189baee51d547142

  • SHA256

    bcf598ddc301d322d584f77e8af0d743bcd5bf7dd88186f5848f5772e82d859a

  • SHA512

    e076dce5fdc7dec44ad18c054dbfd1640312d021b90387a1cd38dab3e1a009862baf4fd782fee311e84c4ba3d1ace3c963693f9fd83a0c12d2daa33ae841e9c4

  • SSDEEP

    3072:JVhpdGEE6P6MF4ABPn3M62B5gUeP5j50+l:JVhTFEJAB/cfyUeF+S

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2