Extracted

• • Target

    6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58.exe

  • Size

    120KB

  • MD5

    c17f990d1d19cd16f2dbe46315f53571

  • SHA1

    5bc328d99a6432e2085cb6f01aff4bbb9fc464c5

  • SHA256

    6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58

  • SHA512

    7250d4eb1467dbfb170dfd5de662268ecca1cd6b35726d6ce0d664b25071056526b314fa010e1619ebf8b07fb8653e068735143bc20be09e9ab08ba16c987dd1

  • SSDEEP

    3072:4rb7pHapnLftKZxYp+wv2X+VXCsfemYY2S:2F6pn7gZ+pKknf3FF

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2