Extracted

• • Target

    d92447d273b5be44425952c8fd90ab68d4f96858b54500a6bf67f0085751f9ec

  • Size

    712KB

  • MD5

    a0054639bdee26bd296fa17eeec70eb0

  • SHA1

    1f0bb5e69ac1da28a7c2e0c34492e1e6df249f42

  • SHA256

    d92447d273b5be44425952c8fd90ab68d4f96858b54500a6bf67f0085751f9ec

  • SHA512

    b41e474b23af45f72fd985a80bd70b2e12960b9647c08fe03e3c4a1632c7b854827c55a89c0e6fe7ed532b3491226d8b72fb21139817b5378db7f2a3a911644d

  • SSDEEP

    12288:MDQNFEyqo3PlzYKXpdqUVTaRGisvrkEZu3lpjbLiTV+W+QW/:MDQNqo3PlzNoUVTacbvrkWCrOT7u

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2