Extracted

• • Target

    c6f6d8c5d69ff190b9eb61c98668f635afc3ea8b042fed81a9e96c9989db9e45

  • Size

    120KB

  • MD5

    3ef91273efa346318e2ceb0b5091e72b

  • SHA1

    410d383eacb6253a007293d4d95de72c01916e4a

  • SHA256

    c6f6d8c5d69ff190b9eb61c98668f635afc3ea8b042fed81a9e96c9989db9e45

  • SHA512

    edc05f7683c5857e419bf96c156c29ade6b0f1d55ec809a96d592d61e22674fab27b475f03944050553c782a1bea06a0943ff98f0c556f3c38a138012e5f79a9

  • SSDEEP

    3072:RheNLyKWA7JY8pjy9gJXyfUokJcYZKsDCQXzkqqJw:RhevfjfX+dkJccDDCkW

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2