Extracted

• • Target

    b42bc91ceb93238f485c1d9d2e27154f3a4b2797f7fdd3056815a9de8850d7eeN.exe

  • Size

    65KB

  • MD5

    3382434050046654751e4c1d3b291af0

  • SHA1

    c8b2cd7034883966d2738c918e47a7512367c2c0

  • SHA256

    b42bc91ceb93238f485c1d9d2e27154f3a4b2797f7fdd3056815a9de8850d7ee

  • SHA512

    9cb90a0d0eadd060ad33cb232da6b279ce09f2a362a6481dfe30b4f52bf1296af9a15309400a0ee798895e0e6fb1d52138ad70b601c56ebd70a7db68e917d015

  • SSDEEP

    1536:0fE9yqNxVD+4J5rgoFXRzogNHcRubv8N3obxUEbBf:0e+e5rgZgeub0N310Bf

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2