Extracted

• • Target

    f8c9eb45c8477c502330281e8c0643642d9d44b384c594f8fa686aa6ecd02689.exe

  • Size

    120KB

  • MD5

    fda11f1fda68372e0a2fec5d02793a8b

  • SHA1

    44fb5d62323a10c5fc92419501f9a3365f8fee45

  • SHA256

    f8c9eb45c8477c502330281e8c0643642d9d44b384c594f8fa686aa6ecd02689

  • SHA512

    2a07ff7e3bc73c90e3c3fb77df1480697a9219cccda5c414f66ce4c487012fc2a2861c8cce371a1e775f021f51a2773419ae4be9016d2d60cae5aabe0cf2d3b3

  • SSDEEP

    3072:uBofxvDEaFOTQ2rAvs2UuVHKWy9yRC8gKIsA8RuOW:uCJvrFKQF7r7y9ttKIsUOW

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2