Extracted

• • Target

    a230b921556d9107971234c2563cac630d4eb1979f0ee9c7a13c096106061c88

  • Size

    97KB

  • MD5

    333c77dd1593273330f5cf1c6a5ae38f

  • SHA1

    558f1d78ba2fe910a48472e6225e65d4b19a8c9d

  • SHA256

    a230b921556d9107971234c2563cac630d4eb1979f0ee9c7a13c096106061c88

  • SHA512

    788de7d7bcaf6e2cda7032c75ee3c0e8ef2bfcacf76c562fb84559b32e471cd6fe8e20449f340da8491b4ef43cab85acd2108509acae16246f156da4c5a3531b

  • SSDEEP

    1536:EH/P1KKCiIS04CQjcTFJa4g0a06RnvcO4YAYzmve:yP19CHXQ4xJav0aZpBAYj

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2