Extracted

• • Target

    7a2052affacaeb572bff87a8da2526e3f0dc0474b37899a3f486bbf2ed33d385.exe

  • Size

    120KB

  • MD5

    ca101923ba8e6c1e78f7a0ca97c6a640

  • SHA1

    a6650144ccc0e5be34e8faec78883c2e25662816

  • SHA256

    7a2052affacaeb572bff87a8da2526e3f0dc0474b37899a3f486bbf2ed33d385

  • SHA512

    c9397a8381d8772b2858c5b57d009631ab54494c8b3275fce1cd00619d6584687f32ca2e8abc6ca4f3ecab752d0b7b7e9171a7c0c8610dc5431f7f9dcf1f077c

  • SSDEEP

    3072:IhnMttJyxvM2+7Haak5XpaTcs423ox3ppBk:IWfJyxvML7HwHkcA3MBk

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2