Extracted

• • Target

    48ad6c60be6f55b4de810292774b08d810e67273665aaca0b2a5dbb9e185a98e

  • Size

    289KB

  • MD5

    30d8838120dcb3dd6650d14311b29a10

  • SHA1

    145973f20453d0c33583cb9dc5780d03181ee0e4

  • SHA256

    48ad6c60be6f55b4de810292774b08d810e67273665aaca0b2a5dbb9e185a98e

  • SHA512

    0775b58e7a9d1441140706362f94f4154aebba5ea98453379538cc9b59db42cf1dc571d131b798e151cffa8eba48f446166ae9876c995dfe067205c10fb2e7f9

  • SSDEEP

    6144:oWByyF7fgMUnTwiYTXP5ItBzkPvTquBMkp:oanFUTXEKtmeqMg

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2