Extracted

• • Target

    cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0.exe

  • Size

    120KB

  • MD5

    035358a6066e22b842f07e71f9f78467

  • SHA1

    a0b764758534a4040de67a990603c55f1c13fc44

  • SHA256

    cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0

  • SHA512

    5eab041dca35ba014b003c113495ad7c0bd971f48535e4d44bcfd11ddc791131027b7ca0930f2240484696ec49ebaa4cec89374263ad8130175cc1f7241fec1c

  • SSDEEP

    1536:oumhzdYs6OaIdVToI5l4OfA5ErhL8r6fRPFt1UAd/HZaBPNlAzxc0oK7ZzqDJxoZ:otNaIduO45Elm6fj9ClASAFu0Z

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2