Extracted

• • Target

    b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.exe

  • Size

    120KB

  • MD5

    eb6ac65767bdfb15721ad2097182a1b4

  • SHA1

    ab920f5b87d1f3af1ca5660e4bdc7e9ee5301771

  • SHA256

    b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3

  • SHA512

    2e2aa483ab5701baea170896506b2e96ddda822639178707667685a109c314ae340f316f219d02afec7ba3f7944e49ce66a1e31c96d8b4de3d6fe36f03f2b273

  • SSDEEP

    3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3S:UZWwYvsmO9X7Oritlh+UWIdcC

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2