Extracted

• • Target

    74253c286ffd16a8f0cb7eec0519e10e871e56db5dd274d14aeb1eb0f194c412

  • Size

    2.5MB

  • MD5

    60df5c5241c16e6c9c822a27be92bb8e

  • SHA1

    67f353b7cdccafa5252e5cf2b2c39bf2abf3f5d1

  • SHA256

    74253c286ffd16a8f0cb7eec0519e10e871e56db5dd274d14aeb1eb0f194c412

  • SHA512

    19c19253644abf8db34134860b032d2f921d73093dcbc4e8643e866073d2d363352c1a3f80b6f432061d3fbf9b11b9b92f6d1f5d1e43c0ba97a41c99b4aec038

  • SSDEEP

    49152:rSI0BLMg7iLR3r495uNIQKwpbwYCDIs7tubTJB59n30xHvBx:rvjt095uNIQKwtw5DIoq930xHv

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2