Extracted

• • Target

    60404ae98c22d6285b7df7a6063ddf2dcae57b62d578e8e89a99f902a24f4080

  • Size

    120KB

  • MD5

    2271e123892d6e455c4ab9b81417ebed

  • SHA1

    7d82fad983dc8e92a243b40236733ec10be8336d

  • SHA256

    60404ae98c22d6285b7df7a6063ddf2dcae57b62d578e8e89a99f902a24f4080

  • SHA512

    caac1e7065e156ac3f1af8a84cba486ba6f1bff62615df4faf4508e058d08c22f525329ba12a993a38a42d7c9c9c07d6548907e4ef7d7bd5d6547831361b7ce4

  • SSDEEP

    1536:FVZSSBbsetpU25+p2vaMIbCWYUsBXLgHlRDX0dNu3vSguHdsUZKlUS9:FVZSShseta28pnMId2BgH30dyqgPUZY

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2