Extracted

• • Target

    ee1e55291fb33aa6cdde8216d1696c57d4fcdb917fb47d0bead9fa2fed2dfa29.exe

  • Size

    286KB

  • MD5

    a1768f81a4b6dec76ca6640f62ff76e0

  • SHA1

    5f0a869b4023e815f1cae78632892e2f9c9038ab

  • SHA256

    ee1e55291fb33aa6cdde8216d1696c57d4fcdb917fb47d0bead9fa2fed2dfa29

  • SHA512

    070046c79b9c9a6896a49f85b68b0a27b7a453119105b3f7c618c012b99ce0f392295c8b1e643590353469c1610b31879caba4c3430826a4fb3134e1dc24d00d

  • SSDEEP

    6144:fSiKFdQky0OLKs4xEQUAjdInjBfaiMkxuz38SrvspvW90lmV3:WdQkhOLKsQEQUAjdInjBfaiMkxuz38S3

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2