Extracted

• • Target

    703fa21d406b5e4382cc471163af2fe391a0b57f84ec1117824b2d999a256c16.exe

  • Size

    120KB

  • MD5

    32654fe2ae581a72e9aa91401c2aab82

  • SHA1

    253c854372ad84dc78e925659cb94a57adc8b1ed

  • SHA256

    703fa21d406b5e4382cc471163af2fe391a0b57f84ec1117824b2d999a256c16

  • SHA512

    dd9f8e2a4344607b6197fba025b1237c6e8f85b5e85656d810ff988a7dacec4003b7b98b44a4b28981668c56c06af79d075071a1ec4797a999cdb841bdd7eb62

  • SSDEEP

    3072:Ho+CyN4Xnld4YwjcNi+g4dzAm8Ws4Py7+14:7Cyanld4HGPJdznjDPy04

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2