Extracted

• • Target

    7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c

  • Size

    120KB

  • MD5

    1cb57e9011adee639e4dceed2db5f5d8

  • SHA1

    9f8efb90419174a3bd43fdf113d752e2ddd3ad9a

  • SHA256

    7f898440d5ac3774e6276842eebf3455baf9b6421c022009f60214418df7ff5c

  • SHA512

    4efddbff561870918f853ecbb131021708c3686c470be06dbb6d3bf6e147be87275779698ac0a729d7fcb843eaaf3c5a29f7101f859dfa1e35d0dbc551c6e777

  • SSDEEP

    3072:/dOQMnvHz9JGBmg4xMdRL0Hfn8iAlsbVw:/D8JG94x0RLU8CW

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2