Extracted

• • Target

    510500eb1a69670ba9c559034a9571d6d9c907514b846baff52d64873ddacbba.exe

  • Size

    120KB

  • MD5

    cb62c5c9747c4eaf9bab2a56b72f0e26

  • SHA1

    50da85d216295635f70e56d6024ad826747811ad

  • SHA256

    510500eb1a69670ba9c559034a9571d6d9c907514b846baff52d64873ddacbba

  • SHA512

    3708afd13c83528c07e4eb6fdc2ef3ef6f2725c419c4c9e314baa8db38878bda944a075f700d85ed35474d1785f4dc477f07ff4387bc99ab3ba1c8ec25f940ac

  • SSDEEP

    1536:jNbQoxG1yQAVrvenhJ+VJL/nL+hyzL8Nw1cT4DePwmSLGneQqfOs:jNcEG1Mrv4hJStL+hyX8i8PwmSL8qGs

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2