Extracted

• • Target
    xc906fa530110b7ba4f169560332654b78dca0e7c3050a976f3326e10cc4e51d1.exe
  • Size 284KB
  • SHA256 c906fa530110b7ba4f169560332654b78dca0e7c3050a976f3326e10cc4e51d1
  • MD5 706755ec4644914377744f27f8e80d75
  • SHA1 47ec6c8718bcd12a8b191afe0e66f8217641b62a
  • SHA512 772d993caf76012e218dd481b3b9bc24710e28fd5dc934d594d3d8dab0065873dced42f457069415cc62ee377938e24f1a7943657ea2de49d65ef7be042d57ba
  • SSDEEP 3072:PnZcDiNos7YbbAg0FunTiqqxEIcs2qNHAWADquXMfgghjCuxI56daIOWTEi06QrC:v4YEbbAOJqld3me9pDvTK6MfVQg2Ie
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoverydorkbotsalitypersistencespywaretrojanupxworm

  • Detects Dorkbot worm

  • Dorkbot

    Dorkbot is a worm written in C++.

    wormdorkbot

  • Dorkbot family

    dorkbot

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2