Extracted

• • Target

    4a7b80aafbccfbb3d234a23154796505f107c377fa5e556eae619360f8e7b71bN.exe

  • Size

    120KB

  • MD5

    222c29f3a1bc08307d9f3510a3393100

  • SHA1

    18bbab8405dc9627091273f45c482397ac2b92d9

  • SHA256

    4a7b80aafbccfbb3d234a23154796505f107c377fa5e556eae619360f8e7b71b

  • SHA512

    22f2de257f41ae3cf2d63fc140be0b5d6481d6326c41f6273cf9d2eb9d00168bd1ee5eab997315bc8b6c6cffaed044b6a3aa1e8ab90d467a91207f47533a44c5

  • SSDEEP

    3072:3lG7qv+zsBwQNiM7x5FlvJXe0rYjy3fQH:4WssBwQx7xVvRrmck

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2