Extracted

• • Target

    fcca444ff3a68a74634ad9c30d7e744cb75559df7914be1a394c9fd4659c46c9

  • Size

    120KB

  • MD5

    49bc890629ad536e6ac8f65f20f1d40c

  • SHA1

    c0e994895307d7eb86cb11aadbecf86a9f64d999

  • SHA256

    fcca444ff3a68a74634ad9c30d7e744cb75559df7914be1a394c9fd4659c46c9

  • SHA512

    79a7aa83f9037cbc7ddbbe0c743a3f7b907b83e6ced1e89f9f7a221f51d4b75f3878e62819c663611ca682cd60a76bee7cc2ff5fa3288e2017c03d1f77fd657b

  • SSDEEP

    3072:N/4lc/b9prS5xZr4R7KDCU/l97PO01vOq6sdPA:F429dwxZr4R7QCKlFtvlA

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2