Extracted

• • Target

    3ee9804b7a3afd2a0664d69cc1a521bba4a87f4a62997f3ebc595587010ca621.exe

  • Size

    65KB

  • MD5

    a288a365153e547eb0987e6d133d3540

  • SHA1

    43e30f698c1226f8ee91df61f9df6560a9b5ab73

  • SHA256

    3ee9804b7a3afd2a0664d69cc1a521bba4a87f4a62997f3ebc595587010ca621

  • SHA512

    f9173573ddf2990840e0781662a3eba0de1f49afb78a907bc654d9c27a5daa9533f86d90f5d9b2900f6fce26a5c1226149faadb61582136e725588a7b019ac55

  • SSDEEP

    1536:pvxIejOBW6LOB5yzKCdUBGlb5+XMnitfoF3zkOuP:pxrOvs5y20t6Mg4DkOk

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2