Extracted

• • Target

    64ca71e9ed639558d338fde2e46698bc05dbb86e3d5f4ead45f2b23d511a8e09.exe

  • Size

    120KB

  • MD5

    12e6a070151c696da0dc92564e42c846

  • SHA1

    a6d5666c9230801d0127215026a79aff83044784

  • SHA256

    64ca71e9ed639558d338fde2e46698bc05dbb86e3d5f4ead45f2b23d511a8e09

  • SHA512

    e70d1a4fdd6632f4ce18620c760343f01326d4c4e56cec5fb54950cecddccd6b9407cb7ab6d4a808018a68feaf6b2fc7d4b32093ddd3218c1673a1c3513073f9

  • SSDEEP

    3072:JVhpdGEE6P6MF4ABPn3M62B5gUeP5j50+lj:JVhTFEJAB/cfyUeF+Sj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2