Extracted

• • Target

    bc787a0b3cf78a818633b1da2fd25ac6

  • Size

    98KB

  • MD5

    bc787a0b3cf78a818633b1da2fd25ac6

  • SHA1

    d645d74aa98cc2143fdc53039f06919e5f1acced

  • SHA256

    7cd3f6dee59805626640d8e98c752117b22a05a3ed390b281c1afc9a9827ef11

  • SHA512

    c1e98b1962fd11218a8dc4f9a4fd8e0e9bd7c5ac1335367463d99e0fd362f3248abf0f81b59bbe53803facc22c30f8820f4d6fe76feaca9fb436c2a5188ac6ae

  • SSDEEP

    1536:r0c8w1cn/J1XBzD0xg++yApNrKucF92EVOy9OMmHzNeNbVsvjoS:r0Ecn/JdBMi++LzcFArkOMmgbq7oS

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2