Extracted

• • Target

    9638fa53854901dce660f34fd2322a735f775a40c10f8495fb102c94d7d8ff0c

  • Size

    120KB

  • MD5

    bcf79abd198d9071341ba6b120e772ad

  • SHA1

    77c9f22968d08cf4373ee8a1b769a041e34a768e

  • SHA256

    9638fa53854901dce660f34fd2322a735f775a40c10f8495fb102c94d7d8ff0c

  • SHA512

    44e7b4925559157f5accacb94221c08a5db28e64b4e5ffa23910e82daf5a277e69b82553fb0155f973f3673e15fa4317c559f05479f46b32d2b19ddb4df74d8e

  • SSDEEP

    1536:XH55LfbHLMKks3CwhGFct0OWkkZIscpl+cVWz/GFQeLwz4SaTeY2fgM18ogCGMN:XH5lHYKks31wbOWkkOXVWz/AjSaT59Y

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2