Extracted

• • Target

    674ff8a493d0c98d32241af84c1414bcb4fa59f31fb9f89c2f0d614eb947c28e

  • Size

    1.0MB

  • MD5

    0c676d6918e3f9df8cc83f2c2f477fb0

  • SHA1

    c64b19215031643f0462a555b182b3674e28d0c9

  • SHA256

    674ff8a493d0c98d32241af84c1414bcb4fa59f31fb9f89c2f0d614eb947c28e

  • SHA512

    9af7b8478355991faac28f2f053a067ecb3c9dc49081cb4fb4184e5e669ac1826b67c400a25c2f2c59979850244d4dd4f07311a5e238ec078bc348ec063968c3

  • SSDEEP

    24576:/CRfD357uayPYgtXsKf0C/GBgTLLMJGONGgOsJnVaJTeKVor:/CdJWPrx0C/Ge3LMJnNLbJVMeD

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2