Extracted

• • Target

    6dcef9fd8b430ac0590304c2b069803c153aedf3eba8b38a4ce4d40520a58b52N.exe

  • Size

    938KB

  • MD5

    b0dec7b48a4a67801612cb0e330479d0

  • SHA1

    f0a53efa3c14f35fcba276885e3854b8690a8441

  • SHA256

    6dcef9fd8b430ac0590304c2b069803c153aedf3eba8b38a4ce4d40520a58b52

  • SHA512

    7744b6c342a19b6ed4d259b777685db52a26f39ec7cdf241ba56c077fd03c1cd102d97d94d4351630e7231ad7835f2566714db77d5f6c2c73e868b2a36d98ef0

  • SSDEEP

    24576:3FENUWuGHt2Ox37Opu0vBVSEj9//k//Ic1hIaZ6tcJS6g:3W6WSm3apJZVV9//k//Ic1qaZ6gS6g

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2