Extracted

• • Target

    71328bd0620f94dd184317201b571ba33853b4437c8cb3846e9ecdfea9749ade

  • Size

    120KB

  • MD5

    36afa34e80f07d6929ec51a3af24f56d

  • SHA1

    bfc64e5c7744b939fbbc0c5e1ef0c099ed75b436

  • SHA256

    71328bd0620f94dd184317201b571ba33853b4437c8cb3846e9ecdfea9749ade

  • SHA512

    2ef9aee6b8f288906b18fcfa40c84cd178e5a818d39209e872b78b240c7f6c477a4de33d0fe1f4bf1febc1e038cf84f25f73cfd7830ae002c00620c95e3f65da

  • SSDEEP

    3072:dk5mMahoIbZ+ZyKwu1FV55X08Pstd0Cr:dkAcA5KFaOMd0Cr

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2