Extracted

• • Target

    ca6e460a60aad4f5b9c1dd51f04b77db0585a3ad4f2be2e6987f6b48342df034

  • Size

    65KB

  • MD5

    75880c040dea147a1f1c92e5fdb6e9ee

  • SHA1

    9a6c9ded4fe8f6a812108b0dd86797b50c5a588a

  • SHA256

    ca6e460a60aad4f5b9c1dd51f04b77db0585a3ad4f2be2e6987f6b48342df034

  • SHA512

    98136af6a041c7b4944a4ca16d27dfd60a42a004b4a9f71599749cd03d22f58bf017d0348bac7f260a9655cd56b3109412511c7beb46e2cbba191168035c912b

  • SSDEEP

    1536:G8qjIxP8e+53x4889KX+tPay9BOsv3QOvUn3UQGkyK1wMuJ2eQDTBwFL:x268e+3jxazhfYUQGkyeuJNQD1wh

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2