Extracted

• • Target

    2ab99f846efa81ccce666c4e0c10bb7f1bc9fdc1436a20a4149032163294dbe0N

  • Size

    120KB

  • MD5

    9a06b1c12d9b5735930e008dd651ab40

  • SHA1

    d826a67d57fe0bc20894d08838c7e11fe4a1886a

  • SHA256

    2ab99f846efa81ccce666c4e0c10bb7f1bc9fdc1436a20a4149032163294dbe0

  • SHA512

    a410d0ff80ae3105021af75231e87578515a7a20c8b8eaa9cf87c81f05b4747bafbe321f6729013deeffc8398d4520ad3876157612ae6e97180bf58f894f736d

  • SSDEEP

    1536:0wwr3aYWFGpg9VcoJczlGwR3L69/A5GxJG8FARMuswwiiNaOgLdzYr:3sp9zlGwx2Bu8+R3wiwaHNY

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2