Extracted

• • Target

    5aa761f6aaaf79d892ad84b35402bda4a8c5565a5e92539053d7a6eaca29b551

  • Size

    120KB

  • MD5

    904953243cfe91862918394d584d0d10

  • SHA1

    bc603016de0f0cf930a108b93adf0e0a3a2e9af2

  • SHA256

    5aa761f6aaaf79d892ad84b35402bda4a8c5565a5e92539053d7a6eaca29b551

  • SHA512

    3de55a7fa947191b329ea9de2247e39c45bca582ab87d6ea1929754b7cad9df72a6564c53fe48268bb50ee14d8b219a93d44901b2164470547187b6786c6fca8

  • SSDEEP

    3072:4PugFUv1nieLcfh2nIEG9TtoHRXmKh4ualXS:lgSv5iqtIEkTtoHRX7hf

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2