Extracted

• • Target

    7e1572fe82db0f91e7fa08c196ab7a9f4782bcabe5c56a2121e45bed36e8e114

  • Size

    120KB

  • MD5

    910da9890bf3a72219620872311541f4

  • SHA1

    53d7ccd2b1c7b7c811d69a19ded211a9ee4a5c6d

  • SHA256

    7e1572fe82db0f91e7fa08c196ab7a9f4782bcabe5c56a2121e45bed36e8e114

  • SHA512

    37ddc7eff326865ac600cc0f7ee85eb3a0e5081b2f0f7bd2c1ea638c7a9cbe9aba368dd87c49143c5e06ea91fb184e5e548c2827d878e64b958fe209524a9338

  • SSDEEP

    3072:kOdQyEFAP2EydKA5d7s/bNomIYgrZAdoH1XSpah:NWye+8wA5d7sTNomIY6ntbh

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2