Extracted

• • Target

    d4ce4dd5f02dabafe3d2c398826eac2998a4c178c6a12f9d1174e9a69873406e.exe

  • Size

    120KB

  • MD5

    702651c2eb93d320cf68b3624a593fb6

  • SHA1

    dfb298da67041eaaf604550156820b17f196c132

  • SHA256

    d4ce4dd5f02dabafe3d2c398826eac2998a4c178c6a12f9d1174e9a69873406e

  • SHA512

    656397964cdfece078125fdb4d6e0e15b038b3e3dfd79d7ea46c9c9615704bba8e65aab4a0048ff25471cfdf869641e71934f45c1f9a7b6bf21b0c70cd26e4bd

  • SSDEEP

    1536:P7cgpmQC8GP1gRG924QYSPzMBLxdLgekKUB/AXSl+p2qKAtHp8iFy+eMCJBhX:Jz1GGRwQYSoxdgekHKil42VANp1F0h9

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2