Extracted

• • Target

    053212f6cabb87f6023a1b21bc2a0f84eaf79b7529cc980cd4a7ad32dd07b0ba.exe

  • Size

    65KB

  • MD5

    5f5362382a6e54ea323b08957e825ba6

  • SHA1

    5b712b9a1d9d92605111e1bb9218b3cacb3cf505

  • SHA256

    053212f6cabb87f6023a1b21bc2a0f84eaf79b7529cc980cd4a7ad32dd07b0ba

  • SHA512

    60cac6eab8773d87cd585e8680af084b4f4ce5dc7304e14f6963513885b3c54f722a08d92cbdf9e346646e3ef9acc59788170adeb70c7afeb8cca5af752c1fdc

  • SSDEEP

    1536:a6+8QYWP6XOyV+pBCGo/+6XhEEbnXA4P8Os50YJ36T:ljxZOyV+psx/+6RnQ4P8Os57N6T

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2