Extracted

• • Target

    dd3ebd0c4faf4fe2be6cbdd956febf647ec83ca11e924e087bf1ef90a62fd3b4

  • Size

    120KB

  • MD5

    900b2d3b59e330136ca274846fd4cc12

  • SHA1

    7032f9b35f177bd041e3c09c61dcc40ea952d319

  • SHA256

    dd3ebd0c4faf4fe2be6cbdd956febf647ec83ca11e924e087bf1ef90a62fd3b4

  • SHA512

    9d8894dd21f532df440edf96e9ffb2d5f5d23b9f335c57881236a8f8f583773e9a283999d8d7ad8ad58ca02e8f6482d853ad02a779471a99a6b1734e15c8cfe3

  • SSDEEP

    3072:dWKBSSrEs8DGtYM0ZRb7NX2Odwa2iihCS6SLH:5DEcYMS9X2O/2V6gH

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2