Extracted

• • Target

    0c01045781500cfe8073045614540798035cf547283a841a43864c4e840bde9e

  • Size

    120KB

  • MD5

    d19df5c8c90e4c96f0111e5ff08063cc

  • SHA1

    e601949c7e5936db6a11dc648d78de759ec83ea6

  • SHA256

    0c01045781500cfe8073045614540798035cf547283a841a43864c4e840bde9e

  • SHA512

    6eb9b4fe0803dde59ad1f829eb786412b266da9d2f2d241bf3d021fdc14e8cc6b651326f30242bbffe2ab1fa8dd2e354d7cf32e7925cfdacd3dca4a1e9ec8b1d

  • SSDEEP

    3072:OW0YEL3OIc7s8zyu96EHn1W88/skh0Rhco:OWXEaIc7OPyn1W88/fevH

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2