Extracted

• • Target

    d7f3f5440400c3ef56d7893ff53ed03bf7579add1d8065caf4fc6fe8bb60a082N.exe

  • Size

    472KB

  • MD5

    ca2f851963b127ac6375c67d634826c0

  • SHA1

    540d2fd76702470e01f9e1b6fdedd0ca20a1bd18

  • SHA256

    d7f3f5440400c3ef56d7893ff53ed03bf7579add1d8065caf4fc6fe8bb60a082

  • SHA512

    5643be0b24b5bde427083db5cdaa19c759ec6563f26e8b247d958208af442afa5b9c773818d4716df689bc2e6322a7097c81890fab4c0f49fc0ba2e970ea8221

  • SSDEEP

    12288:Zr/DQBliWQapuDkmYlmD43FWKKykIQ54vmOfOxtLSN:ZjDQF5pcimCFWKFlvmoOxtON

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2