Extracted

• • Target

    b4c57c8fa5eb475318aefad0e332aa5056064476694beacacc86323430a07a71N.exe

  • Size

    120KB

  • MD5

    ef5aeeb9c7064b6ffa40e7dc93291c50

  • SHA1

    f72858c2d18c0d47986ba84851ef5eb3ebb4dd05

  • SHA256

    b4c57c8fa5eb475318aefad0e332aa5056064476694beacacc86323430a07a71

  • SHA512

    20a4326bfd38af3249435e89644ca2a3be217e9f77667530cf3a269b17adf7fe7e7e877572d71233672026b149e84c37996c23837347b0f891cc4c9fa10723e6

  • SSDEEP

    3072:LCixXchlE7LpWYcyu9HtFiyB0KHX7T34c:L32h678DyugyBLL74c

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2