Extracted

• • Target

    6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849

  • Size

    65KB

  • MD5

    bf84dfd1b31610af5ceb4179b7e1458d

  • SHA1

    3968111e1f49f55b643e3291544ab5e948094891

  • SHA256

    6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849

  • SHA512

    dfeddbceb7456353a335d64aac46bc61c57df3a9925ff98e1c92b7a136b4a1391aa690fc874611067ad35576959242bc783b52aee8c53a101e53ea54ca6a1da9

  • SSDEEP

    1536:49Uvn/1Zg4pzyci4msuIGz46k8Cog+gcz1viLNn9Yh:YUftHpmci4mRHkloAO1aLNnih

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2