Extracted

• • Target

    56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54.exe

  • Size

    120KB

  • MD5

    f19196937de973f9268ecd8f6ca26c8f

  • SHA1

    d6d1657ad48f1bfea960e212b9432eee61c126b5

  • SHA256

    56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54

  • SHA512

    aa2c109a08ab5f8354133b6b50c49dbdd573b1fb8e9f1ae87a8d52fa898c80ee2f2e659db4ecf7f949519a501a4a84c4bdd8b79de4c98c648c70800130ca23e2

  • SSDEEP

    3072:zdpHLGyQBVcoHoMcv0+dtsyHRd1wnEyXeed:fLW2KoMA0+dtLXOnfxd

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2