Extracted

• • Target

    e525cbbccf6ce76ccb51d365dd4026252c3937a03a4bc57c9887854a66c517f6

  • Size

    120KB

  • MD5

    af933bf227889fa42bc7b33057637f6e

  • SHA1

    763c5db95e36f3ed970e323974e3c7986c5e3921

  • SHA256

    e525cbbccf6ce76ccb51d365dd4026252c3937a03a4bc57c9887854a66c517f6

  • SHA512

    ebfd6c8f49aeecd435a128ee01abc5ca835a78bdc08ffce3add09ca2d8480106f1d5bb3dbd67f1cfb788063bb24ab6f53a41523fbbb3ac51715db7d419c3c6b5

  • SSDEEP

    1536:g9W2vCKyMV2/C+uCMuh7C2ruwAPw7plEDqT7Ez4Il9zjBOdcKAAKrGqOjxd:g94K5IqTptmA3qTAtl/OehrpGx

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2