Extracted

• • Target

    7df2f15c74913a715f788512528faa53f5ae4214aa70f68198d407f172e7c0d5.exe

  • Size

    120KB

  • MD5

    88622bd3eff75a907b5c9cc4f71cfa08

  • SHA1

    7bbc9f785560b28a9e00bc8a97fab2af8452fee5

  • SHA256

    7df2f15c74913a715f788512528faa53f5ae4214aa70f68198d407f172e7c0d5

  • SHA512

    f25daeab790751b5ddf6707b3194b6fd652dd544ed5cb71815a832403305426c4ceee7bc43f25a9a8b18cbd131f4f6449eb9cc3b71a9ae6113b38bda3efaa974

  • SSDEEP

    1536:o29KEEppnoQGJ4SAbIRch6CFuArYcCDXBpIF/LOugRtOwAyG+52hyr/lJ1KM9:MEEjoNJ44ch6gueCDXDugRbvYhyBJ1H9

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2