Extracted

• • Target

    602bf618e9d31d99031944b2af409062df46f2e7cb7a409c7d15f0fbebc95cc0

  • Size

    1012KB

  • MD5

    90afabb304c0a32348598bf6ea2c3eff

  • SHA1

    9135f3e8e5410522f024d636fd61d1f0033f0df4

  • SHA256

    602bf618e9d31d99031944b2af409062df46f2e7cb7a409c7d15f0fbebc95cc0

  • SHA512

    2d7866132511f94d1b0b6944b065e62c03230761958ea70106000298962468a19ab91c76d9137941ce462e353c8c529a97d1bcd47b36467c505c9f5ddce85fc6

  • SSDEEP

    12288:RgdLZ77GT7GmYRpuEcutuFY1hGoksq6iTZaAZaWZSZvd9ZEAPRzaO2J5KLY9QRso:RgLGTpo9qlBAP66ZDGUoFKiYBE2

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2