Extracted

• • Target

    035cfcf0b17ae7fd0e83f40b5086ebdcb93e54f0b9cdc0a14cc8cba16851a64e

  • Size

    120KB

  • MD5

    fe874efb6df7b1c2e86b2d3b40ea9559

  • SHA1

    b7767631bd1d0b7fa8635b1b3723ea7fc7966d41

  • SHA256

    035cfcf0b17ae7fd0e83f40b5086ebdcb93e54f0b9cdc0a14cc8cba16851a64e

  • SHA512

    799915b2b11b5397d1614a43e170e0a3f7d493adead0a7cc83c018486c5fe5ce1d8c3959eba0751e56f7554a61e8eee1fb7747fc7164b932e1987b67ebcafd96

  • SSDEEP

    1536:CiZZYOE2Q0WVBx1pBrzkZ06/4mWFF6EpnNVpEQkHSQz+3YHfPJcTTz:CiIOEp3/kZ06AmWFF68NVpVqi3afiT

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2