Extracted

• • Target

    e1edc778479efeb94b2f40f5bf51cec4c0f864a20dd4d503eaf531b4802a397a

  • Size

    1.8MB

  • MD5

    807d68ebdb37828fd0ad2d56c19e7137

  • SHA1

    374f5733cd546fb8e88b41633758dd4c9ef0bf71

  • SHA256

    e1edc778479efeb94b2f40f5bf51cec4c0f864a20dd4d503eaf531b4802a397a

  • SHA512

    72ae4df233dd3f10380bf299343c52a6fb440ce48173c3ee11addc3a32935fc82fdaaa4b0b10c1f86436e9a88af836cd3b0447e6f130c0acdb59e40527d0dacd

  • SSDEEP

    49152:aFxErb1F2gqQF6d8RrycC51DtuoIwgpXIfWzbnoP2qDA3rx:iGb1FLqQF6dWry//DthQiooP2qDA7x

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2