Extracted

• • Target

    f1369ec294667a73390265d981f648d6797630dfa94fdcfd8ee8a9c7c367891b

  • Size

    120KB

  • MD5

    ddf5a3cb33c7032338657142e46f913c

  • SHA1

    36692908cfcb572c5f56e4b5a790116e770979df

  • SHA256

    f1369ec294667a73390265d981f648d6797630dfa94fdcfd8ee8a9c7c367891b

  • SHA512

    dbb96c22bdd90aa1f406f98b67a80fa3c46263569a573fbeab2666f41578015a35e8a25ddbd0201a2ef0ea189a507114102145a19bad73ae9f7ada2c826e24ec

  • SSDEEP

    3072:Co/EeDBLybZPZy09nILXO3esCitqJFCi:ObZP85SOwt89

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2