Extracted

• • Target

    ede5b7c1d4779068ce5f5f2442937caafba146ad9d729dbe38229e869f3b9038

  • Size

    1.2MB

  • MD5

    ba6b3892770aa59258cdd2688ac65458

  • SHA1

    b9197af2545efbd4d08c0642d4f26f7c7cba14d3

  • SHA256

    ede5b7c1d4779068ce5f5f2442937caafba146ad9d729dbe38229e869f3b9038

  • SHA512

    8568170c85f8f1fc610120611272cb6e9ef6a4f2294353596a02efe42310ecb81737cc3cde12d522f86bac559fe5472c611774223cda64f78fb8987640a61119

  • SSDEEP

    24576:S2rgoy9bk1k3ObjdCWzZoAJXp9I4/iH62NXjNL9GBTFL//WqPVsh7yKArEH7jX:/foA3e0L/H0OKX

  Score

  10^/10

  salitybackdoorevasiontrojanupxpersistence

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Modifies AppInit DLL entries

    persistence

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2