Extracted

• • Target

    cbb981eaa145b754c1663defbfb0c250f2569602112dd4c71d23b64249c4e6aa.exe

  • Size

    65KB

  • MD5

    4f3751aa3f3234ba5c9607329e564aee

  • SHA1

    250532b09550f94940447ffc43b071737073f866

  • SHA256

    cbb981eaa145b754c1663defbfb0c250f2569602112dd4c71d23b64249c4e6aa

  • SHA512

    f5bd4a1b0ed6357777109bb69230d42c5b216d7992b94b0fff7a5371a836247cbb019d588d9fa59bf280535e51906b9432c2db6ae74cf4a444de7b8993a43b3b

  • SSDEEP

    1536:am+UrdTRH96qKGKiWNUtlwTyX73VACtPEs7Unw:CYd1HZd3tO07qub0w

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2