Extracted

• • Target

    446bebce8587c568e36644b1787a6b349db7c0d5a9cbcd10a9040f975bf1d7c8.exe

  • Size

    120KB

  • MD5

    0a0e151ee92f1236916407d2f7d953a7

  • SHA1

    052d2a9fefc20828de93b570852292cda4182cda

  • SHA256

    446bebce8587c568e36644b1787a6b349db7c0d5a9cbcd10a9040f975bf1d7c8

  • SHA512

    0ce3e221b940f4edc2d9b93bab9ca6ec78de8b2ccd6c662b4d40740b639dd3f3ce198352fea7cec555c2a5da3d507867248fd197da4cb5ea5d9fe27a53d3d743

  • SSDEEP

    3072:4BLVLc2HTB6j+P4qc7v6B89XOPnZHn2lN:12zUj1Rr6B89XORHkN

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2