Extracted

• • Target

    8214a469a9fbd451c9eb9b0a3df150f9c92df7021124f468284dac3c64630c78

  • Size

    449KB

  • MD5

    0c126287b8276ab5155d4346186bbeb0

  • SHA1

    5966f2efa23047166467cc86cf5b948d80a7403a

  • SHA256

    8214a469a9fbd451c9eb9b0a3df150f9c92df7021124f468284dac3c64630c78

  • SHA512

    9d7c6bda93e3dc720e367163854dc825d0feee7005c72c0a0a60f8f9e5c0e244fcffa5d346e8ce733bddcca86184c18047d4a4245dc8fc92f76240a0aad8a2ce

  • SSDEEP

    6144:7IpasPTvQ7Eqs3b7smSgAAPqqtNjrYrI3U7o25vODuBzSaKnJ3bo:sk4bNAGhUN7UDuBzBKa

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2