Extracted

• • Target

    654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e

  • Size

    120KB

  • MD5

    8cf2bfbe41a50952a72d453ff8e53285

  • SHA1

    9bf3b00b470f0f77f7b9c14cc5f691cad9d79d4a

  • SHA256

    654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e

  • SHA512

    f5e0ab3f64610abc7093bdf7eedd4ba6b766a4056ca068b376d86eb37261dfde7a47785d3d0fec23fc03a79fd7332d9c6bac466c954eb208643545f3f24e437a

  • SSDEEP

    1536:HoUEnIGDTRjdb2c1LIq/gUltBkOkDx2nqEu8VquOnMfHiqfPs0GlYs2UpcmD:CIIjD/gUltoDxYqED4uOeXs08BN

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2