Extracted

• • Target

    935d226f91449e4d243d56a373884a5faf919da723297ff232b1fe2eeb9b679c

  • Size

    400KB

  • MD5

    abf9b15567a215088c8f20a0ce75b0fb

  • SHA1

    887d606c6b569e2e914c44978920da6ed39eb050

  • SHA256

    935d226f91449e4d243d56a373884a5faf919da723297ff232b1fe2eeb9b679c

  • SHA512

    aacdbb0b69d56b935e11ef161b7af6f2d1e58e3876ebf03d0dbd79e4d8829d115a446d4f28052292e283ae5d2a1b410bfe99f4883af30b8939d88f0164472ac9

  • SSDEEP

    12288:kSvkHGOfU0+BaSNaeP24r676z7vMuTZbJNMUZ0jtKsz:kz/IvM6ZbJNMUZ0jg

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2