Extracted

• • Target

    f5100890606375df60a4d34418e93f9d052ea71aa6d54b02afa85aa98ce03d6d

  • Size

    437KB

  • MD5

    80f9cdfa52b6870a442deafc3b0a75ef

  • SHA1

    8abb794e460de56ca233e79bc3b21d0714bcd3cf

  • SHA256

    f5100890606375df60a4d34418e93f9d052ea71aa6d54b02afa85aa98ce03d6d

  • SHA512

    4b76f59a8823cc57efe7dd198c99c1d188b5f899e51ed9b4fbd87b1f55f48a242bf7930fdb2e2701dd847b73f6eb00fa7b7b6e999f2874ba485642bd9178f93d

  • SSDEEP

    12288:f7xu6seCKjYc12mrezbp25oSHUHf189U9safoc8J:fFCKMFmrezd27U/u90W

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2