Extracted

• • Target

    2212d22196d4fc805f3e322e3411f86376bd72dd81e74edaeff807536929e58cN.exe

  • Size

    97KB

  • MD5

    259a2c251974419b495b488ccd098e80

  • SHA1

    46fdf341e9fafb0beefe83e7766a31a7292a70ea

  • SHA256

    2212d22196d4fc805f3e322e3411f86376bd72dd81e74edaeff807536929e58c

  • SHA512

    255f0df84b61b059a8602e1d47139e177fbcdb2c95b3e3352f66f62cddfe3abe0224ad8acdf253226864a2dc6c13f89d117e9633018752301744f33bb2acdd47

  • SSDEEP

    1536:O22dNCO2w4OHwnDSRslBvH7wglSG3tne/njs5f9bU2TOHNk+R:O22dojw47ORsnMglSme/nI5fW2KHR

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2