Extracted

• • Target

    107422e5c55c5ea4ad321cacdab0f66d

  • Size

    790KB

  • MD5

    107422e5c55c5ea4ad321cacdab0f66d

  • SHA1

    ed7b84a5f2c0dd080c3f0aef2052df2e70b31b06

  • SHA256

    47c1e29d75f0b3fc798031fe4914cd9ab14e777b58c75385584c66e8055ba5a2

  • SHA512

    4e3c39f96d4e9799f8e1d5f529af95ecafdc28bad4009de34bc31f4350320a7043a1ca3c46c9781d7ff04b436dce96facdeaa1fdd85be5bc16bc455fb87f0877

  • SSDEEP

    24576:hjrlQOKtsccKww+BR78W+mb8pL/zRj4zgsy/ZbFdMghJ3:JB9nJBBB8pLlj4zgR/JP

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2