Extracted

• • Target

    04e5ec36e2bc17e7d4de17879bded48e49410b0581f136b87f61466e957d9214

  • Size

    120KB

  • MD5

    2d5d3da53b31c7a02f5e5ce99060c705

  • SHA1

    110d8bfeae7b89a4afff98fd0c441996d02353e6

  • SHA256

    04e5ec36e2bc17e7d4de17879bded48e49410b0581f136b87f61466e957d9214

  • SHA512

    8d95ee5fb5b7676a6d1c43420eccfbdf43048bbb27f2a6b753a9481486d7cbff3d66f7f61a524c40e8110f23e6eaf2a86bd1f4f3bfece499fa986c7dbda6e2d2

  • SSDEEP

    3072:xyegdmgLCcPvTMtNQQsgk9PjNlJT1R2Y7Nj2MRCqK:HgLKzQQsgEPjNLTD2Y7Nj2M8q

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2