Extracted

• • Target

    32345db6f83b5e90e3c46762e43e0425eb0641e082be1a2e48cf4949a4c3bfcc

  • Size

    65KB

  • MD5

    825ecdda71af3bf75ee5d1322b278462

  • SHA1

    61599f8bb235ac0e78e592e4fc43006d36f49a3e

  • SHA256

    32345db6f83b5e90e3c46762e43e0425eb0641e082be1a2e48cf4949a4c3bfcc

  • SHA512

    dc0016868bed9bc22be73c95b1bde4cfd296de57e1b8096a7e265084010c844b785a2dfd59c59d8b4c330a07e5548084fd4fe657e2ae6152c5f1d4e3c9ff2697

  • SSDEEP

    1536:BjoPqOMzvf/Q9HMrdFFhhuCorwuLd93/oPm1or:NUqOaf/Q9HUPs5Zcr

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2