Extracted

• • Target

    3408cf93803aad207da389fbcd472dc0a4e362add871b53430ec4af2f9bc1e6f.exe

  • Size

    120KB

  • MD5

    efd00b594814bc8b9b7c1b21099d46fe

  • SHA1

    9e2595583fc34db25aa16ab4c27b8e68bb489490

  • SHA256

    3408cf93803aad207da389fbcd472dc0a4e362add871b53430ec4af2f9bc1e6f

  • SHA512

    dff4b662e1e49a5b899d2aec7c371d314f62b481f68a69f1abd841263ea416ce7f9cd59a810fb2620b69005bec6ca20d478df81a39312b6123b42218a39e4d13

  • SSDEEP

    3072:LCixXchlE7LpWYcyu9HtFiyB0KHX7T34c8:L32h678DyugyBLL74c8

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2