Extracted

• • Target

    ecce4ca71867832c435c7e8c15b353beaf937f256be58bc7881aeb2ffd0fffe6.exe

  • Size

    120KB

  • MD5

    9387d4c33268f67cb6994f3aae5dcd20

  • SHA1

    cfb23163138205b465006625f2bf7d5874430afa

  • SHA256

    ecce4ca71867832c435c7e8c15b353beaf937f256be58bc7881aeb2ffd0fffe6

  • SHA512

    75611217386056ce97c3a0a22b3c6fd6e29d978880bae73622705be5370cd5a0897455bb7f614d0d9d2d8494aeab6ce64267944d43cc5b1626d1feb478d8c586

  • SSDEEP

    1536:1NDpJwXf4+dU5ia8IsBwen/OoerqVkCNrXKWk7Z4BH2dXXbnhRVFtfBKndnri0nl:TrwXf4TgVqe/NHiCp6W0S92FLnNTSPS6

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2