Extracted

• • Target

    e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26

  • Size

    148KB

  • MD5

    8c21a370bd149784cb7128d666543cc1

  • SHA1

    7ad1dea7887f3f8256825b19590604b0d2c5beb7

  • SHA256

    e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26

  • SHA512

    5a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0

  • SSDEEP

    3072:eahsmpcReL9DxyjcI4zhawZ1CWRtHD24gEtYqniX:/hsmxLKIaMrR12lsYqS

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2