Extracted

• • Target

    384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06

  • Size

    120KB

  • MD5

    8a84216e35fdae131363fc35d234481b

  • SHA1

    d48a7f60350db0afbb6322fe8981dc360794766a

  • SHA256

    384d041a8f5e99096dfb3b2b70ffe60af816e1ad97e0078015c0bb98c210ee06

  • SHA512

    d57b587e6ce6649bd7c45e7e70eaa4a88275c9d837428f1d59430a003c60fcccf30d1866b0cff0eec4e6f8d5000b37942a3f87e5c6b3fb508fd9fe47d5d1b9b9

  • SSDEEP

    3072:Wo6PYLJo1zXuE2KUphJ8abTX3wPph149ldJZg:ngf1Dcpca/UhGfJZg

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2