Extracted

• • Target

    caf65315fdcc0664436d0a9fec09d65219e984e4eed84d18b56f455cd523f7d0.exe

  • Size

    120KB

  • MD5

    3118748792120989afacf9baa4526fc9

  • SHA1

    f497e14d806ff502282429dc4cc6df76a75a74ac

  • SHA256

    caf65315fdcc0664436d0a9fec09d65219e984e4eed84d18b56f455cd523f7d0

  • SHA512

    e80e3dbe35f013facdb2b8301cb86ae5676d95c5477baa235c559e9d415692fb0cb276807669b2054abfa1d1f0fcfe2d5ba4a5bc7216841049dc73876e5c6708

  • SSDEEP

    3072:VO5xxM3U+JBtxuSIKoCau4kSo3spF+tA3Ma/37yYsk:siJXkiReUspF+t/a/Ff

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2