Extracted

• • Target

    8d5b14b4b08a30524b29acf7fe650be3c2478dd3e89bcb08ad53ce6885d3439c

  • Size

    120KB

  • MD5

    8046d48452b5524ecd05dd50260308b3

  • SHA1

    b7c9ede30d32ef96b1c87f47456778c04bd584cc

  • SHA256

    8d5b14b4b08a30524b29acf7fe650be3c2478dd3e89bcb08ad53ce6885d3439c

  • SHA512

    851d9637b0104c6aa9f65cdd2732ae9b52cfcef0da52ba7f2381d137803915c831f1c889e1e2ce7ebee6972ab2a29d590726df4d58f6bfc9d1d45ab6e128859d

  • SSDEEP

    3072:8SVE0MTZqOMcjiOhGxg3nvzuVvdNWIttxPh:8SVwdqB7OhGxg3MjW

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2