Extracted

• • Target

    5f3bf2dfd4d00db5783f275f078baea771ed94bffc586e98c094429d193830df.exe

  • Size

    65KB

  • MD5

    b2aa09ce03375392f11ed1c2c762f88c

  • SHA1

    562d6c605e3f9d3f6276dad3215f721fb9ab5cc2

  • SHA256

    5f3bf2dfd4d00db5783f275f078baea771ed94bffc586e98c094429d193830df

  • SHA512

    1e586589eecefeebf036796017b587002fa93eeda660c717b601e3f271e64b42a4aed9de43c51fe94ea80f8e59a9a1ef9ff65e04f6c261c3424a8850b060e5b2

  • SSDEEP

    1536:fWhKpVZ6B6VFsiMs82Wg7Hr5kIxmsLX7Y0OlO9df:fWAL5VFsiMs8a7Hr59rcpk9d

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2