Extracted

• • Target
    554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee
  • Size 229KB
  • SHA256 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee
  • MD5 fbe68b4b3a364438b8d37ad71886fddd
  • SHA1 b3bff5cd8b635afee7745bf0e2be705582b1b5dc
  • SHA512 0f974f353170d67d81ba318d46efd94ebb15744823a6b6473663cf6edfa96dee49f02916fc75403876aff4e766c3146296bbc34deca6391bb026537a2e57623d
  • SSDEEP 6144:U8U2qy6rRZb7jxb4EJmXg8x+1C0UY9ewAqDaJ1sGvjq4:yzy6rRxuxmCk9efqu9jf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2