Extracted

• • Target

    6f77e34ff80d41b1e0b3be005989ffc113050b7cc4278540cf630b9012b50b42.exe

  • Size

    120KB

  • MD5

    a53b8807a2100eb7d2534138d3a4b61b

  • SHA1

    fe75888d30ba62225436d7eb256a672d705e7547

  • SHA256

    6f77e34ff80d41b1e0b3be005989ffc113050b7cc4278540cf630b9012b50b42

  • SHA512

    e8bde7baecef7625839f063f0b294c95b444bf71902c5651d4827bb73a8328d1006d2cdf28739a82132c03d2c7b4f874ece99dd9924c24d9a633d5a496e545a5

  • SSDEEP

    3072:a/SQpWL/vAkKqtn7a+UEyXRLG+ZjMKFiFqaz7vynd:a/bWLnAkKqB++UEoR6D72

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2