Extracted

• • Target

    6479166852196d4f20d57822a9bc7b3ae8ed44b31de22a4aee60bfd5404a60adN.exe

  • Size

    65KB

  • MD5

    9b2c1bca12f410e3ca845ea67019fc00

  • SHA1

    bf2a8583a25775bb53c8a517a070218f2db62dfa

  • SHA256

    6479166852196d4f20d57822a9bc7b3ae8ed44b31de22a4aee60bfd5404a60ad

  • SHA512

    f43e4f1775626279f88e85414c7f5f32e6a1f0a44e242d635e1013f4613f4b922168c6cb7071f0b4ed9aee5b6047de8e41a1b2a5e5fc53076708740ba953f4cf

  • SSDEEP

    1536:PWZ77pwwTigeVimcYsYAzKpaa9hHIl/1v7NxYZ8P9H6e1G99cPY2mQpc:Ox7uw2QmcL+paUHgvlPtnYAPYn6c

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2