Extracted

• • Target

    5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb.exe

  • Size

    120KB

  • MD5

    d5e8a734e669cfdbd39ee8a18fca8263

  • SHA1

    7b0333cee3242aa01233ffe32ff2bed3d82ccfc4

  • SHA256

    5f720eec438f34d61725c39bb43bf889b1d9cd2d2dd5a1cbd33e3c4be00f4cdb

  • SHA512

    b2802d7b7e86699523fd2cdd1aad913268660bf3d51b6cd9ff2e8763e5311c75cad895cb35ccac47acfa939f01f7bcffc54bdf76c70c2c4d51d297496a3a5816

  • SSDEEP

    1536:cQaEvFtfCvdf8r/mH2CNFNPKgyWG4QhDPvPolIg8Hu8ouaO489iXuR/dTReK53Dd:Aot6dUrenKjWQhDRg8O8MKiKdesYPi

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2