Extracted

• • Target

    2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3

  • Size

    4.5MB

  • MD5

    c416f79abc133720bfa858d809dcd67a

  • SHA1

    a70d987f23ae26187e62dbc11ba362ac239324c6

  • SHA256

    2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3

  • SHA512

    694f9da9a45762420193d255cc1b8328db80e03651f379173088383760a2301a2ca3e164e6a0fbf37d323b9ecfd0b159100e8d81f75c40baed92f6f820c29d39

  • SSDEEP

    98304:zPs7jiynjeYKWy5yMSq8QkTZNhcbaIpV4R6I4HnCHfe8bSxmR/:bsniynjeYKWy5yM2QkTZN8aIzHnsjR/

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2