Extracted

• • Target

    1131ed239930c01d4e1dafce024824b57169a66e270f8efa91fb8f3c872c4af7.exe

  • Size

    65KB

  • MD5

    85f0e2b42e70a2e4b299a747eebef3f2

  • SHA1

    fd7ef438f2305055d2b2cd55e4a5ecaf4f1b1293

  • SHA256

    1131ed239930c01d4e1dafce024824b57169a66e270f8efa91fb8f3c872c4af7

  • SHA512

    a706e8ce7c1dd04edfd9b9c5680c40166345028c9f84c346110de28f3a3eb81468dd1591f14dcc1cd6d46624c25c84b4b2ad0d7dc181a10a1e6c7cac58d7d899

  • SSDEEP

    1536:Q7qv3stPfcbdV2f0dP3OrzGOx1BRxcd9Ylwpz:Q7k2cbz2fYeryOhRad9YSpz

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2