Extracted

• • Target

    8eca66c3fc09cbb1d6f524018761ad05faad4d5546c94fe0f26b30f66df33f7d.exe

  • Size

    120KB

  • MD5

    93ccdfa20282a0613f5237ca4e73458e

  • SHA1

    cf8deff5fe4f9846009690e6e087eb5d3737091d

  • SHA256

    8eca66c3fc09cbb1d6f524018761ad05faad4d5546c94fe0f26b30f66df33f7d

  • SHA512

    20a5215e8e7bf657e8128d039cd230928739213165ff1f65b4ba4b230a00d2acf468fa163655349daed5bd062dbd1ad7f174e363e6981204fd6f8d8f75f66311

  • SSDEEP

    1536:DpT6/31Z6NhGIAluABAzi3IeiscHtQe6gOPaiisMElqPkYOMKAXxm:sP1k7GIALAziIDNQe6libPsYg

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2