Extracted

• • Target

    9464e2541a606af5fed79a8cadd8d2ff2ca96ff8e0ae10e8dbe02441b4097363

  • Size

    160KB

  • MD5

    0a09382defd574cb4ac448be447d8d20

  • SHA1

    8630a52e878c608088eb5020bd2e0ba64e564199

  • SHA256

    9464e2541a606af5fed79a8cadd8d2ff2ca96ff8e0ae10e8dbe02441b4097363

  • SHA512

    bafa85792e6c52d2edd5cea5df705a90d69fc397614e4edc4e5f9d2d926a7c24ed9dad8c6744dc9e009bdcbbe85332a0c7d7b5f5958fdfce915cdf17f58a05a2

  • SSDEEP

    3072:UwbcbaeClYXISBoDLP+QtBVFPS8yXjIysn5OGQETD36L/iAcy92/ViiQ+l:DYbaeCIrGXWQtBVMrGz336LaAcykp

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2