Extracted

• • Target

    7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0

  • Size

    120KB

  • MD5

    91e805476f0b556ae29499c19a0515b7

  • SHA1

    20c591a471e9fd8a0633b1c52eb2e75891804339

  • SHA256

    7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0

  • SHA512

    b213346d7e6ea655da63df58c3a8ee1e6739d0d5f6ff619c2f231011c0a2cf96f71725ba7e55001ea1ec18942d384a858fb9bfd1a757dce8eeed4f4fef6bb3e9

  • SSDEEP

    1536:7aUeJS6T/2lNdFutdDAmoY2jC2/ptDjkpBhOk+94pZO+UZVjT+hwF3Xk4URxtYrY:7abzquc0MC2/fjkX4No5GVvSt4yxm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2