Extracted

• • Target

    3cefe18fbea53f21746d29fb592c43faff505cfd8b9216bc29994f20d9193359.exe

  • Size

    120KB

  • MD5

    47cb3007b9215438ed4815b7184c4184

  • SHA1

    9294f6db1952b958a5f3dbc6ce3c619addffd39f

  • SHA256

    3cefe18fbea53f21746d29fb592c43faff505cfd8b9216bc29994f20d9193359

  • SHA512

    41be5948a1ab5a300f7a25da5eb2391febfcdd922868251e9be96d3a40895e35979b556b1107e8b1fd57d7f086f056a5b20f781e96919ebbfc091f2ba31c3dee

  • SSDEEP

    1536:f56vbyxLU3W1mQPoy3xxmgTZRxK4LcvL/bFzPCfZt77KYDwP384Hvvc1fxdLW:f4+xLU3WJ9xZZXCzFzPCff3Ismvk1a

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2