Extracted

• • Target

    4b2af9375ba4f9ba8292b321904a389c59811d5df1672fcf451ebfe7edf1c8f5N.exe

  • Size

    2.3MB

  • MD5

    5120687b58c696d6dd278c33b8f602c0

  • SHA1

    2f943de41a955cf57dd986a76be5ea2ab2f74106

  • SHA256

    4b2af9375ba4f9ba8292b321904a389c59811d5df1672fcf451ebfe7edf1c8f5

  • SHA512

    1d9b114a6fbe63cdc62d9e460956a178871bd43dfd58abdf91fd965ce87262a3e482b313a9c6d8d96e23db5d896e9ddd4ab1766ca35723e1a9a3e82b39d921a4

  • SSDEEP

    49152:eSqLS9g8pdEbrkchyOn7pPGEKG/DAW2NzG3nJJOvw0:eSJ9ubrHRpPGvEX2VG3J

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2