Extracted

• • Target

    2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3.exe

  • Size

    120KB

  • MD5

    4f84da1735f64fdfa4c85ab5a088bedc

  • SHA1

    95ecf60e0ee5d73a67dce7b694a4354239e3265d

  • SHA256

    2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3

  • SHA512

    af845dbbe18854219e356f77bda5962840df6235fa449d96eed1be3965b36f3ac3696ec4158bdb6de288434c1b38f9945a0be7dc5562e39088ac7fd139342c85

  • SSDEEP

    3072:CjC8+52JfyUtXx/DlJ6hDLCnzTr667fDd72BSI:ClLZ7ZJ6hDunnrr7fDB2d

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2