Extracted

• • Target

    5f7d016f80850ca27f66204100c2abd1676d351a28ec837074feefb8c02f4612.exe

  • Size

    120KB

  • MD5

    e12cc72445a28afa54f9e6117c474ff3

  • SHA1

    4729e890c5b9b3bf9dd5ff6ae6918dd39042ba0d

  • SHA256

    5f7d016f80850ca27f66204100c2abd1676d351a28ec837074feefb8c02f4612

  • SHA512

    fbdafe0acae90392c7b675b24e4086b32d21681c93cfef3dd52c2a68e0c5fa9988056a0c9a9a422959846f8507d139a4a87a054553a1e9bb95ad9160c6a03630

  • SSDEEP

    1536:CACzdHJsBu7zQ7KCqsSldUc3pxJUn08wOiYCHyPPk8o0UM/vXiWk9vZkYAVRJaVm:8JH6u7zwha3UnziTS35pvSJyVOaBVT

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2