Extracted

• • Target

    1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd

  • Size

    120KB

  • MD5

    a2f3e5495a3e63d7a6c4ec9a5e1ea3fa

  • SHA1

    68ff880f1b463b4557b051f5369253fc9d97f574

  • SHA256

    1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd

  • SHA512

    0ec9022568dc0e60677fcf0b54bc46d72b228750305adc084614892bd7363552ecbeb4c38698f021a269598fdbfc9a3f509f5920a75438b5b8fde14c16641918

  • SSDEEP

    1536:pWXl0zrZ97nnNIxzqEha5PHvEUuzQ39iwsftKbrQED1HH7t+y5nL20N15a:pLbnNszqN5PHJnowsVSrQEp7tPn

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2