Extracted

• • Target

    95059c3a41b69fe5e1e9541f9154077f8a6970e92fcd95b538ba750b26e9ecfaN.exe

  • Size

    120KB

  • MD5

    e6865723ddb66b3526e8f5f882408800

  • SHA1

    c9edb8b59fd2586523e1ad74d6c67d8547e2421e

  • SHA256

    95059c3a41b69fe5e1e9541f9154077f8a6970e92fcd95b538ba750b26e9ecfa

  • SHA512

    a86021be4c79bb4094f12ab3e6350a83d30840f2564b360e95326b538bb5ed072c5d77e3256990cbd6c9b83944c1a5e9eaab732e85101f81d78eafd69705c059

  • SSDEEP

    3072:spQG4mKVGceRPNoc3Omks+1c0yM6KKsC4aMayz+LRp:eV4zBe8c3ysOyM6sC4aMayaLj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2