Extracted

• • Target

    3ebf754acea1b81cfab8358bd92173389ce402e911af6f98b11a419b9e95a7dc

  • Size

    379KB

  • MD5

    06ef6a37753f366ed7107e64cc072690

  • SHA1

    e7fc48232ce94aa6c574bcc179d59d556063f62b

  • SHA256

    3ebf754acea1b81cfab8358bd92173389ce402e911af6f98b11a419b9e95a7dc

  • SHA512

    8228eb35f4ea00af964be4ac3fcdad94bff4865c819dc447060021698d08c6d3aa940591b9fac8d2c92195890727d0280aa61b16047bd5e6483322c46a432fb1

  • SSDEEP

    6144:Mmie2t3VsUScBKgszvitP84nioG/jXdVmkmmBYu+T3mWsQgR:dq3mrcBKgsbiz4ukmxWW6R

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2