Extracted

• • Target

    2df2e82a9519f271844fdce23289fead2c77dd0e98ef1007c188a73f1b20e9c7.exe

  • Size

    120KB

  • MD5

    8a8acb2d9d035198c999d2026bb28cda

  • SHA1

    e5efa9ac3ccb328756c8ff5c421df757564ee377

  • SHA256

    2df2e82a9519f271844fdce23289fead2c77dd0e98ef1007c188a73f1b20e9c7

  • SHA512

    5af54b080a38c4fb50763b6d8ae58bfcd7fe9ba50e4f2b7abac1bb7e1c79c6bacba1da67e81a2e3a18d71f8a691aac21f8c49623ce5b848cbd2a5b426a429869

  • SSDEEP

    3072:xOaU4gT6omZjkc+gnzdQaWx7VZLXjNo03+NNT2Qp:xX66rnnzdQvRZLXjr3CT2Qp

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2