Extracted

• • Target

    5de0299dbe2413374f9003fc4b8b23d341fcf9ad154905db150a86a48c7eb35d

  • Size

    120KB

  • MD5

    dc5904042265468018a8af25edeb51a9

  • SHA1

    5f01c5b720512d225f675d6c679bedc4c5d0b1ab

  • SHA256

    5de0299dbe2413374f9003fc4b8b23d341fcf9ad154905db150a86a48c7eb35d

  • SHA512

    97311e743d9e51b988cb9bba2bb7b83710e312892c9db8194c7dec9e5729a749a98b3caee7c15a4e1a605f3f07dda46c8b2a9c83d6d7b6692b96cd2e79028c98

  • SSDEEP

    1536:bj4j8cZFHYrVTrgV+OAOvu7hIbxCWuS5i0cp8+mmaEhND4SYjA5JqV9mQCOkVHP+:bj4AcZ6VOvumD14lAjA/+HyHm0oZDV

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2