Extracted

• • Target

    436b0655bc4f944529ae2e0285d12d2ff6c360030926185da6227a36251a0b5f.exe

  • Size

    120KB

  • MD5

    32733b923780ffe49fdd41704bfe8de6

  • SHA1

    5a7bca71f8bd649c87539f8271dc54ea0c897289

  • SHA256

    436b0655bc4f944529ae2e0285d12d2ff6c360030926185da6227a36251a0b5f

  • SHA512

    d85c66784e0a2011ae5553491ffe886fff1822f0430e7a520981ade55d408e014e39bcb0bdd9b6c3e4ee3fa7245d2090e9b6323b4b520f5b5a5598e1b55a3270

  • SSDEEP

    3072:2vpALNdy5WfswwJqeE0V9Fc0K1cDXW4CbOiqt:8pONkUsjzxnKaXW4OOnt

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2