Extracted

• • Target

    4ce49f90ed3fe7b87f65f06a4869d1cb5571676366055faa3a2aa804198ed441.exe

  • Size

    120KB

  • MD5

    65af5dcd5b3e7ca4611f39ceac0793d6

  • SHA1

    f9be32490a2236eee089fc0747d23a35973c7750

  • SHA256

    4ce49f90ed3fe7b87f65f06a4869d1cb5571676366055faa3a2aa804198ed441

  • SHA512

    eb1fa6d6658f7151cc18adeefb6ac967da85a19559354cc2f4436949d4669460baf9680a4fc5d2b3a54342f364866b6e15c38c1458607b5a3e01333965c41654

  • SSDEEP

    1536:x3Y5OdlsWrwDQ2V+bwtSYx6kRsQqQjm4bIrZ+nIItiHug2xeGjPRcTHCClb+7:+5/WkJ+bzE6kUIm4bAknDiAx3Vxx7

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2