Extracted

• • Target

    8532c838d237b27edc0387a05936f774bab875ef79655c0eabaf061dedd17db1.exe

  • Size

    1.2MB

  • MD5

    b22250dfcc325407aeaf83b61db94c7b

  • SHA1

    f8aac8d4a3f02bf715ff130cbd9c4ed49e0d477a

  • SHA256

    8532c838d237b27edc0387a05936f774bab875ef79655c0eabaf061dedd17db1

  • SHA512

    3a196f45fdbad694132b83e5de1c20daa2ee6b474cd25cbfbdc8eea8e76898830d05ad19e1966f3eb809e26ce63e6d0ccc51ce1434b3827162d23aaaa4578377

  • SSDEEP

    24576:GII2mRVMuLi/mDnICLJ4gxqBeC7/ATDNoo3cK0Ef2gsODWdb:JmRV247qBeC7/ATDNo2+Ef2gsODcb

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2