Extracted

• • Target

    63613e35be0f7c3209e3b01397a790d360071e804d60fa6789372acc8988dcd4.exe

  • Size

    65KB

  • MD5

    d6fb9978e15d0d9d5eef8b4eee3acac5

  • SHA1

    fe10ee905765c27fc04c6983adcd560df6eea8de

  • SHA256

    63613e35be0f7c3209e3b01397a790d360071e804d60fa6789372acc8988dcd4

  • SHA512

    9116d74b9203f12844aceb11046cedf7e96d1a02b41ee6dbf23438aeef9ab3f623b85926e6056978b24609a16cc35c6d15d6229d797f4333970f17d6dde14055

  • SSDEEP

    1536:oRefsfroWRLF7rvtM43zGrBJCO1/RXQR+Z7X6A8YgHPc:oRffrrNLtDqrCu4+96PDHPc

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2