Extracted

• • Target

    8cc7de7617fd026490164271f3792603327fe251f3b4165980b30564d6a981e2.exe

  • Size

    120KB

  • MD5

    81ff6c3cfb68b9a155f50fedd6043985

  • SHA1

    7363aabe455035c4bb95c068798190590f2b02ff

  • SHA256

    8cc7de7617fd026490164271f3792603327fe251f3b4165980b30564d6a981e2

  • SHA512

    d48c25d200419bf50d80d164d443452a0a05d56aaa5da3bb58b3db15c04afa5d3a9b6c78ca872fe3828d08cc60b3f2c7d4cb71008abc7f6c6ee0e74c46db7ac7

  • SSDEEP

    3072:suDeambp515fNW4T4MnOCqb9knnL4Yo2V:VDj2p5DfkBGOCqbKLWK

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2