Extracted

• • Target

    b9ba1ac421fa2b27447bfb9aeb3239d418c2a2db57ef75c7b3429a90b8c2534e

  • Size

    97KB

  • MD5

    a3ac7a77366f0312dd67bbb9989e169b

  • SHA1

    0c317f054d9ebf10f8aea4f6a77c6fe89971292a

  • SHA256

    b9ba1ac421fa2b27447bfb9aeb3239d418c2a2db57ef75c7b3429a90b8c2534e

  • SHA512

    d82403ff443d72f4a0f3be4268b3ba32af6f539bdb5b3e11daa862cbc403f0f51c0db2cd88eaaa8c4cae344f998a59a0bc1b274923832b877c55a7d8eb8a5cde

  • SSDEEP

    1536:Z0iLuFuWsCjN04UY4F8xeZVu5Bm/Zqw/7ZBhOj3ZQvCglHFb0gFfadNpLuF:iPRxN04UgQZVu8/Lp+JQv/lHFbFFsN8

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2