Extracted

• • Target

    6debc71c4c074f1ecf145c13ab45d1fcfb277213073929b69986f6aaa2807245.exe

  • Size

    120KB

  • MD5

    43f3db01348ce08eb7222e1e2ca87809

  • SHA1

    0c1e5cbcf8a737dae98d70a2f19bb70f47ce0008

  • SHA256

    6debc71c4c074f1ecf145c13ab45d1fcfb277213073929b69986f6aaa2807245

  • SHA512

    f1802d4f86e90f288c7b553946fdba9e09cf4d411aaf2a9ef59f96d6639a352d96cb894b39803f44f9a8e86811f5226d1f3a7283af1bea0636b4597abf65f1f4

  • SSDEEP

    3072:b5W6E3xTMFg52U2G6Tkctvzw8iYI67Ps9eEri:c6EBmi2U+k0wYnPs9en

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2