Extracted

• • Target

    e6feff0ba5e5adc36ff5fd7924aab028f4ca4a864e1590f7999149af0cdb7facN.exe

  • Size

    65KB

  • MD5

    a00994ebecffd0547c3a4e1b043564e0

  • SHA1

    fc9f21fa4d1514e5ece42e717c6410380a8d6be4

  • SHA256

    e6feff0ba5e5adc36ff5fd7924aab028f4ca4a864e1590f7999149af0cdb7fac

  • SHA512

    d0a1c9b117d1ce1613ffe51ac7d779ebdba331925cbf3bd594e487abd3121c994bcab07e8a0ef3f0192bfd8f60c69969439b8844c045fda877c4e9466bb5d8cc

  • SSDEEP

    1536:vE4KuoYgDAqoCDGaFEAuGaueQronI5iJtVg89oygRuy7d:0sCqa6N2lhsz194uad

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2