Extracted

• • Target

    c4c36ba668965c7d89ea05924e4f80c05ec70194e7ad6c32a308c31b4f75f4f1

  • Size

    145KB

  • MD5

    49178a72748497998ad3bcbe9f123920

  • SHA1

    2601e7f8dd1f2d7baa102ab59a90f526e1644d94

  • SHA256

    c4c36ba668965c7d89ea05924e4f80c05ec70194e7ad6c32a308c31b4f75f4f1

  • SHA512

    2e19335c014f13cb6b5171386c42ad1d18cc9314027673a8aa5207630639c124eac0834d58f89583df73839bbe7d4ec98e468cf477cd877caf13d116f13251a2

  • SSDEEP

    3072:xc3Bx85+ue4m07yKctJjdqimoNBH5J+sAaqAUOK1I/L6B3JxIkr:23x0pkJkimoNtne8z8xIkr

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2