Extracted

• • Target

    ff677bd34d7bb7ffa2145bffe054ff5f11cc37f2b0357e0505ce94e500064923.exe

  • Size

    65KB

  • MD5

    ffa06ac52ab85564a5c925b110177547

  • SHA1

    3883a85216a8d9b0726a1369d3659fe4927629b7

  • SHA256

    ff677bd34d7bb7ffa2145bffe054ff5f11cc37f2b0357e0505ce94e500064923

  • SHA512

    81143bc55fe6ed278f478e5118e7ef13c6bda5e5c89bd39549249989a7c97815381fa7d26227efcbd9e41d51a60df3eb8de3458c6fbc40a07637f0801e74bdb2

  • SSDEEP

    1536:oYU8/ZSt+Xm+SXhNBaMYqrRI6S5pnzJSSTu3/Q+i3Q:oYz/ZSA3ihNBaMYbrnzFTA4tQ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2