Extracted

• • Target

    640fed94d1633479e0edb2d50ebbbc5706a20209b3130eeb98810d009a2a76dcN.exe

  • Size

    97KB

  • MD5

    a1e6de730ba006985a5f2132245bd4d0

  • SHA1

    4646838a962b76be0198bfa97861cd478de137d7

  • SHA256

    640fed94d1633479e0edb2d50ebbbc5706a20209b3130eeb98810d009a2a76dc

  • SHA512

    039e3758e632b452f85d6f50805986e77eb824188f91ca47c8158bfa7be180e639b8f18a5ea8c40e275089d0d890995d016cad6df72fef3f2e8d476bb7afd0f1

  • SSDEEP

    1536:KUucKQn+yIVjviPU+0d/6upPpWwx5VfoRVtBE4lHIZAcskm+sh:b9+yI0U+0bpWXLtB60kBo

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2