Extracted

• • Target

    1fba41ce7ee3d2bf277e794008dff1299c6d9679f3949408b6d75a4624e244e8

  • Size

    806KB

  • MD5

    7d5e101054c5a22fccee087db7764bd5

  • SHA1

    ff95646fec16feacf1b3b3bef88e97077810541c

  • SHA256

    1fba41ce7ee3d2bf277e794008dff1299c6d9679f3949408b6d75a4624e244e8

  • SHA512

    0d180f1ec4699622c8819c2db29aa467fb846c80637333b3b59dfb8b7715f7f66fa3e00fd02f3c93d53e45966b00ab9788ba3c80b0dc9df8d3084584282c6cee

  • SSDEEP

    12288:CITsqgmDWSpR+Gqo1gOSJVSKdet5RVu5ihnYQspCp9qWvX9fRBrGZz2AE4Y:CIXgCWSpRyodSJVDsVu5unzqWvX1D

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2