Extracted

• • Target

    eb15f0dd46225fd42d695fb59e0c9af51fb3e044474eb91edc720f1f849fde7b

  • Size

    120KB

  • MD5

    0cee5d8e8e0eb33fd3452ed36a2e9fc7

  • SHA1

    1b5478e48fe5c50aeeb7b442f79afbe9e529f29b

  • SHA256

    eb15f0dd46225fd42d695fb59e0c9af51fb3e044474eb91edc720f1f849fde7b

  • SHA512

    8165f6b684183830b1ec7bd0dcfb0b44d02db328884bfe0d5c7dbdcb9b7d59439b7943781ca674c9adc41e2b6d4434513fb5de63b277ac54458039ec8f33544d

  • SSDEEP

    3072:8t8jbl+hLVCE88y22OcOaRz2z2TV7HZkWOFA:i8jb8hA38y2up2zy7HD

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2