Extracted

• • Target

    ad027fae58fbd890f80bb80a67c86887640f2983235d48860e52069aab7b6bf4.exe

  • Size

    3.1MB

  • MD5

    0f6f7017b58cf6f981bcf9bba99c5019

  • SHA1

    e2a08c6b3b57db785486aeb12488823892083cfc

  • SHA256

    ad027fae58fbd890f80bb80a67c86887640f2983235d48860e52069aab7b6bf4

  • SHA512

    066e037e26eb104c1702ee0cee539c46f83c46824d9af6f7065ba2e508004b5a7089548f12fb2e03b736bc16f398cbeaa3d04972d782cb089e4bb7cbc0803467

  • SSDEEP

    98304:m1DJpSOVny93BVsPj2hv/rOqTAeix00WT8+JpSk:oD6RVsPjknrZTA7WT8+p

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2