Extracted

• • Target

    961b0c2623dcea79d3bfd91ea08803b7ca7cf5360115c2dfd95904e9a16f24cf

  • Size

    120KB

  • MD5

    308d284168ea77763814251a9ad54a72

  • SHA1

    9d1e3b9df5aecbf07179b48fa5f2aa5e1a1f918c

  • SHA256

    961b0c2623dcea79d3bfd91ea08803b7ca7cf5360115c2dfd95904e9a16f24cf

  • SHA512

    159abc89646a73eba94ca4af47663fd20a2f5c71c7c2931691b9b0de8e7493885d23b64170af978767f3d4419d3f187de56833403fdce863c3b105eb58348dd4

  • SSDEEP

    1536:nDdIp97WZjSRLxQlBosMIq//sjunZijc6cnhIJnCyzuW8EV5jsQ0rwo1/:5jklpvjRijMUnCK+EV5gJn

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2