Extracted

• • Target

    5bea5e192ace7c08563f23198c71a433a5c5da05f002b642ba6bd481a8d6b8fa

  • Size

    120KB

  • MD5

    cfd4ed35d874eab4c394d99234886c10

  • SHA1

    d4eeca9c9ab2d8c8452008cfd8d9b54dedd190c3

  • SHA256

    5bea5e192ace7c08563f23198c71a433a5c5da05f002b642ba6bd481a8d6b8fa

  • SHA512

    0379d613b41b39afdb58b1f88554a92dfe118e8dfd9b975cef27a6b7d09369d9d410bc4cd13dcf675700370ad564e907ff3b33bc5565129ccacdef25aed1b511

  • SSDEEP

    1536:9Zdk5ZW766g5o7VtMz3IIgC/q7xtwoZBEugVbtZieVIEbhk0Biu+Ys:MgWH5kVt8gC/gtwozEvVbtseVp/1+

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2