Extracted

• • Target

    1417352ea2414a1becf7dbec3a6351886a4629ad8f53785e5c02b1d5bbf32bd5

  • Size

    65KB

  • MD5

    b6213dd8e79d8a54a516978d094d0f19

  • SHA1

    c3257c7ec5614aad2095422c315e47515937aaed

  • SHA256

    1417352ea2414a1becf7dbec3a6351886a4629ad8f53785e5c02b1d5bbf32bd5

  • SHA512

    34f959b10803ef809605f082e20a19b09935b98baa72354311b0cb398575c3a0064de983d83752885b84ebd304f45e5f2e4895448c7fe8432478b9dcdf39e89e

  • SSDEEP

    1536:PnDaTPVNXqiDrzCBk83zCum+AqUlvol5x9eDxFWfiQ9D72DOf:WTqQrh83M+elwHGlQJ7Tf

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2