Extracted

• • Target

    6d46fe199625dc11fef055cd59a3a687c773c5c3daf7d46aae0cfbe6eb8db95c

  • Size

    140KB

  • MD5

    10a15616efa840348b448a15566221a0

  • SHA1

    d18e0e8e09076e50b21a74015ce0c9f43a325f86

  • SHA256

    6d46fe199625dc11fef055cd59a3a687c773c5c3daf7d46aae0cfbe6eb8db95c

  • SHA512

    1a11bd43259c9344dacd7e37746724c8ff8a7e7032bcf8c0c389674d3e12592608945a29a37edc5d8407e42ff6a7749b752a834fad2c50960533361b8b535bb4

  • SSDEEP

    3072:vGfewELA9HsfRnewjc1/qMkOWywq3xU4sGixbHHQaU2Lzr/4RBInnbSqRoADx:vGfBELA9HsvOYq3qLxjHQaLzr/4XInnH

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2