Extracted

• • Target

    b6ec162d21f1395071ea6ecc01703e06f49af364ba549d258fe59a389ad625c2.exe

  • Size

    120KB

  • MD5

    7e24df6abedc806b0a28ee9bebd99060

  • SHA1

    792e4090f46d747d599679c66c4e3184cd258c53

  • SHA256

    b6ec162d21f1395071ea6ecc01703e06f49af364ba549d258fe59a389ad625c2

  • SHA512

    0ed21168f2925fdcd2f6fc84acabea773c8726f8dfaca73c4fb7cd7df5c71f808c0c87a49a0d9583f9c0420911da5dde0dc6810811967d8d52a8ef3930f50001

  • SSDEEP

    3072:VkhYKY/qKHgSL5njZrGNkC5pwKHTy+ckztD7cospJ:7K6qgV5jZrOllH9RztD7sJ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2