Extracted

• • Target

    73cd21780bf1b1431ed1d158d43d373d5508654d0e28014a309e8a171305295e.exe

  • Size

    120KB

  • MD5

    c27e581c1fae21b533ecd64a2bd026e5

  • SHA1

    afd79090d03017737ed237572cd1de330631f214

  • SHA256

    73cd21780bf1b1431ed1d158d43d373d5508654d0e28014a309e8a171305295e

  • SHA512

    f1af37a122f304caafdd5e058b1b57d894d662abc3cef9f5483efc8868a47b4eba6edd0f28871a145f73ce271386c81a5bc539211b9d302d62aba4fa14343be6

  • SSDEEP

    1536:HoIy6l/Q3h66pzBPnH91Sur5kMBdJlrnvYUQm36E/OJpdckSOWefr87Fbsi3EsT7:bdpQxlBPdguqUDvYU0qkDl3w5bsilT4m

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2