Extracted

• • Target

    1c4cf6c6bac1ca99664bfb82b77357c99a858dea5bfd929f4e299e93e7c04938

  • Size

    65KB

  • MD5

    12b6616bdc948e5d648ff6d753230a71

  • SHA1

    8b92305512b8d53ebc9505efb268ea9e95c1d1bc

  • SHA256

    1c4cf6c6bac1ca99664bfb82b77357c99a858dea5bfd929f4e299e93e7c04938

  • SHA512

    a88b9ec87762c1a0172e30e03c7b7694e1487be0ea9d29ba194843c3e307f3d56fd9661d946c028377d439d742725596f15e01a94b8d7c5e79228b8d5c169a47

  • SSDEEP

    1536:e9IcEIQxdYXu3vyIxPOows+PcYusNVP7bcyti:eKcfylTsowfPcl0HE

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2