Extracted

• • Target

    b5c443265eaa3d3cd2e54481ef68fa15cc188107a130af4d6eb3654882a1f486

  • Size

    120KB

  • MD5

    360c97700bffa464699a8fa2e6e417d8

  • SHA1

    27fed44aae9248625daf417a536338a7e997a098

  • SHA256

    b5c443265eaa3d3cd2e54481ef68fa15cc188107a130af4d6eb3654882a1f486

  • SHA512

    edc73061c1689de82a948c53f9eba59eb75e8d242b818564112dd85565ad03684bf4ca8c0b0fa37df50daae0f9beb960ab5526fc69dd2146c7a7abb901a80f39

  • SSDEEP

    1536:r2Abx4SLivmRTqtZ5fbp8stVqyVLwW1u868nj0CIwB4PEHdjj77gPWvlyxzPYecW:r54SLSZ5zbVLw8nj0z8gEFj78uvlydJ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2