Extracted

• • Target

    9c8383ea5b939be71de101711c3899ad45fdaed7588e12e6aacbacfe8a237687.exe

  • Size

    97KB

  • MD5

    5a7297204cd180ff8ba3b6b8044ffd0b

  • SHA1

    ca7cc6ae496ca96e6cc6cf5f55e1b82b6b602d26

  • SHA256

    9c8383ea5b939be71de101711c3899ad45fdaed7588e12e6aacbacfe8a237687

  • SHA512

    0cf07b2974945809163a051b88decbfc713d0396faf158d29bc752a307db4f5e4f42ad570f212fc9345fb8a4ca6e8eaf14b5c1af5be94434184762c957e963ee

  • SSDEEP

    1536:/btp+o4uYIQ2yuWuVZ40jNXOuMHJd2FmhOjXHuQFKLQUf:/btz4uYIRFjNeTHkXHuU4

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2