Extracted

• • Target

    5378322baef7c79e2a6bddf97a42094b14695804a9ec16d472ae2dfae4ca96fc

  • Size

    93KB

  • MD5

    6dad3db67ff15142a42530d5613b2b3e

  • SHA1

    79bc6f592cc226f296e949c3e36f2ea740f81b00

  • SHA256

    5378322baef7c79e2a6bddf97a42094b14695804a9ec16d472ae2dfae4ca96fc

  • SHA512

    15145fa89e7b3d2587b4615e0fe579d166c09074a6287a3921f900195ab6d6b2f25a5d8d11141da1db7859c0d88d4906e5a94cf0cc6f6e37d08300055975bf12

  • SSDEEP

    1536:cq824LckNHsvcl35JnOQATN5C+DJ+y/FX4U/QuMrNSQsKbDAsjCN/Pa:cxLTJH35YQAT2+3NXKuPQT8/Pa

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2