Extracted

• • Target

    53e11a7f1af15c79f8f9754848a83df8cfe8ac4285112091891723dfbb6217f3N.exe

  • Size

    120KB

  • MD5

    3dcab5020f0f898999da07240cf91c30

  • SHA1

    6fda3798efbea060b2c81578771317058bd76802

  • SHA256

    53e11a7f1af15c79f8f9754848a83df8cfe8ac4285112091891723dfbb6217f3

  • SHA512

    ef4f00ac76ca4e5ee37818727cb6c504124a6a87afe6c55d4ca5113c0a635e8b0dd9c13a9d25e26146af606120fe212b1f76afdce7e4eaf6090715904e9ee63c

  • SSDEEP

    1536:CACzdHJsBu7zQ7KCqsSldUc3pxJUn08wOiYCHyPPk8o0UM/vXiWk9vZkYAVRJaVD:8JH6u7zwha3UnziTS35pvSJyVOaBV

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2