Extracted

• • Target

    fa0a7e3c2e7d085c37b110997cd41a0d8704948266540f3d4f9af0f355391cd6.exe

  • Size

    120KB

  • MD5

    0893496f09c36ea9ade4dee18e9c2730

  • SHA1

    db2a7ed33b227a807b7293b3e00382c5b709fdaa

  • SHA256

    fa0a7e3c2e7d085c37b110997cd41a0d8704948266540f3d4f9af0f355391cd6

  • SHA512

    8069e8e21c29e05757acaea0981ba91fa1e7d224434e3e788d6f34a37959a26f361c346abfa347b681ef8bd08f0ca3001537bdb11a55d7ddcd9c8b1a5d91898c

  • SSDEEP

    1536:Kf/Wj6Ja0xSdsrZDlqzm6fudKfTusbKTCkDdkybW7eTUmfkJg7M1Ygd2/eNOovef:Kf/WxYZpsmo//bKGkDGQW2pfYygEeDef

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2