Extracted

• • Target

    be478076b42c08c352e2b141bb33df6ddcd56fa1d4fa137b0eec45543561569d.exe

  • Size

    120KB

  • MD5

    92d07287990f1e05899a4d6ae1be6b7e

  • SHA1

    a95a1004f6af310a393a4f8782ac1c1b54b2fe60

  • SHA256

    be478076b42c08c352e2b141bb33df6ddcd56fa1d4fa137b0eec45543561569d

  • SHA512

    4c9132650734bac604c7511520cfae4c156d2f2c953165fd460fc41ee4ffc6fc73d5dcefed07d9b02561e353f1afa6287435e0c020f8e31f17a363142f20d596

  • SSDEEP

    3072:QN+fXR9V4SMp/jI0a44Upw0K1yifBi8qfJW:Qwh9g7akA1ZJpqE

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2