Extracted

• • Target

    41a8eab15335dbbe98720ab5ebd03078d259fbededbd0f990a0a6356d7a0210aN.exe

  • Size

    120KB

  • MD5

    946c71a4a24c8243da4c53d97ea7da80

  • SHA1

    5211ec2e55f4b16992c44619c6b206a19a4f5c83

  • SHA256

    41a8eab15335dbbe98720ab5ebd03078d259fbededbd0f990a0a6356d7a0210a

  • SHA512

    809aba0291c7fab39fd7c7fc7b03f58773807bc0f0d8d7849648dc7c345fd637b6a871811f88a7d912e362ff737f8725f08910588706a660970a0ebc83ee6c38

  • SSDEEP

    1536:sQacd9sE0Pcd0sygp4y5I5kXEA1tkrkU8qU7fGod64+/vbkHkTb:sQNPsE0Pc+lgOiokH7i8/fx64+34kT

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2