Extracted

• • Target

    021868ea55e754cd7abb8e85e53027c94357a7dde2c6f9c7e938b42136067403.exe

  • Size

    97KB

  • MD5

    42f41f03aa72f3e68efc6ab815b258b0

  • SHA1

    0fe8dcf6b6d11dea15906f617e6952b9aa823495

  • SHA256

    021868ea55e754cd7abb8e85e53027c94357a7dde2c6f9c7e938b42136067403

  • SHA512

    eb0d8f15da939e4ff6bbaa9678d631d43b5f8646ee25aaced74e24b34154b545f5ad65afe5e8cac519c492fb649b939b57da8cca79f331e074c6a2dadecb8345

  • SSDEEP

    1536:l+eGvhVG5xg8qJLJHR0LkfMDq4xtYczP1NmvTBBgce5K4HAVNQro76:l+BhVG7m0LGGtx3zPeOorV+c76

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2