Extracted

• • Target

    e4b758df63cc6b7fd9c4338f323e65e600e5f1bccfb1567eacb3ef086310db57

  • Size

    120KB

  • MD5

    7c9cb78137589adc5c6b9967edb83da6

  • SHA1

    09e343c658eecc757dbb354b67c8719da78b3b27

  • SHA256

    e4b758df63cc6b7fd9c4338f323e65e600e5f1bccfb1567eacb3ef086310db57

  • SHA512

    8e0acf6ffef5553a2f5717c68028900a41a122f31b8d5138c80f5f6c8dfba7efa99d6dbe61f8ea6200723da432f4d9e213abc50b2d43110d8b79f6975b1d47f2

  • SSDEEP

    1536:uLTKC0jhQm3mwnmJVngPgXOs+XuF441T91k+7cCZj5X+QwjWxvCBgT:XC0FQNYmJVgcOrr41T9jDZd0W1OgT

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2