Extracted

• • Target

    99c60186c570a0ef4e6951e19c714216ba6e7f4f27c3e68e135ddfda89876878

  • Size

    120KB

  • MD5

    474edd37a54d3f8b36ced305a5512794

  • SHA1

    866c29fbc94bd5ab80856366a8a6c0b9048dd27f

  • SHA256

    99c60186c570a0ef4e6951e19c714216ba6e7f4f27c3e68e135ddfda89876878

  • SHA512

    951e75d90fbdb08aed2384735b7b07695500d39134fecc9838fa1890a2be81f38c604008e6ae005cc98d0b2ed238ffebcaa8046e4d51915f85a22822d7186109

  • SSDEEP

    3072:nPkAecUa+QNyH3fZEPCTF1dm2adHwAzN:sWUdEOvaPC/3axjp

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2