Extracted

• • Target

    c52509f0fd2a0d02f79feca22c3c50d8b6a90e316e5f46b3b6a16fd925bd971d.exe

  • Size

    120KB

  • MD5

    9dcdca614d8517d442fc455925c83a5b

  • SHA1

    117697cb3921f5f8ce903420181bdc348e2fbb88

  • SHA256

    c52509f0fd2a0d02f79feca22c3c50d8b6a90e316e5f46b3b6a16fd925bd971d

  • SHA512

    9abe1123b3fb495e718e3b755f95769cb761e9f32a48683fea1ccd44498be3fb39b708f5ef35dfa0d3e83c24596eecf0eba7a62c77892c8a79da923974b8d5f9

  • SSDEEP

    3072:BPecF/pvjQ4U7rHnHEGaIu6/i7oC/QSfg1x:BPecFBMPHHHEGaIL/i7PIOm

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2