Extracted

• • Target

    ec9547fd25b919e13b4cf8ca1e1efddb928474f9c268ade1fc499ba464818db7.exe

  • Size

    472KB

  • MD5

    7e9d458b4aed8aa40440414ec8dfc836

  • SHA1

    6a2a7a95c4be7dc204e34cddbdac37ad335a1540

  • SHA256

    ec9547fd25b919e13b4cf8ca1e1efddb928474f9c268ade1fc499ba464818db7

  • SHA512

    8fc9ef59f0edbd8647ffb98b9b1064f628b3a0a34022706dd6d19adccd95fa00e4c69860d9e0e7f053fbf64d2e2fe4becf5ae19251a3103177595bc0417163b2

  • SSDEEP

    12288:Zr/DQBliWQapuDkmYlmD43FWKKykIQ54vmOfOxtLSv:ZjDQF5pcimCFWKFlvmoOxtOv

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2