Extracted

• • Target

    5fcf6b663a9a0deb24562ba250018d680df3939c598c873cac5df65b90ac5b97N.exe

  • Size

    65KB

  • MD5

    2f95133cc9bdbd4e02ba630046363c30

  • SHA1

    1611c63b919bd1541877f7674e3b5f354f64e106

  • SHA256

    5fcf6b663a9a0deb24562ba250018d680df3939c598c873cac5df65b90ac5b97

  • SHA512

    7227ea93a322f097fb2e01112d0f3667a582b4ef43c024abfa14c8755346372959947a38bf6d98824c6e1290b9a5ad89ad2b3f5655a7743f8be7be72539ddb09

  • SSDEEP

    1536:dujndM/Ecaz6UbfzITxsP0V7n6sWf33uJbQ94oFR0508ai:UZFpfzITRVD6sWf33ebmL0tai

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2