Extracted

• • Target

    e305e18e59f5be911380e7090cc16e3d40d32944e1f2b5cc27b4b1b4049ee69d.exe

  • Size

    120KB

  • MD5

    d29c1469b7c2fda4d2181c00ef44db5c

  • SHA1

    c3ee846124b99d3cf09cddfd1f7c5ffb28a22aed

  • SHA256

    e305e18e59f5be911380e7090cc16e3d40d32944e1f2b5cc27b4b1b4049ee69d

  • SHA512

    4576637396f483ad45bc9d27c250140e1b28c56ded3b7e3431538511be1a41be204b0677d8e9b0164a8d3d364142e0a1282d041f48e2e096646cc33b87ade6af

  • SSDEEP

    1536:RzJm2IidseVvz7kFRzmqkEbLpJfFccNUuMMZGz:r1z2etzYPqq7Lp5M6Gz

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2