Extracted

• • Target

    c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28

  • Size

    120KB

  • MD5

    4ea451f141767fdcb54c553e43e8334e

  • SHA1

    eb947bdf0258435b1882277c8f490ab055f24ff9

  • SHA256

    c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28

  • SHA512

    c939489f875dc8114f0aad8caef8595d0d1d77113c89ad4be9c0848bb239db48288e98aa70bc467d20e7f3b2991586cac10ce4c2500b08ad097deab351066b03

  • SSDEEP

    3072:6daWzpyumPP7u8Q7ApWaDcn64LD/+1S31WAsGiq:6da8UK8QzsW6im1tfGiq

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2