Extracted

• • Target

    5e191cf5fb861f07e84abfe21b5cc45ba492ec97a88b7dbba16695c8b18f0ab2.exe

  • Size

    65KB

  • MD5

    d7c832b29cb6d2bfdc79de2f527dd578

  • SHA1

    6ae8b613fc8714779e4aede697b9f4506ccc3364

  • SHA256

    5e191cf5fb861f07e84abfe21b5cc45ba492ec97a88b7dbba16695c8b18f0ab2

  • SHA512

    fa9f4fd899c12577e305ab2ba65e7eee518c9147c7ae6ccbd1fde9e15123f5784dfe5f8ee9782cd05b4fd08059ba27213c81ebae3e31d4867763107affadd49c

  • SSDEEP

    1536:y/6RbZ30yXzdski0JEgRAYJKRSiedwzsLJx2N18dR4RKwo:DRbZPzdlvJE2JIDg1qaoRKv

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2