Extracted

• • Target

    b0d70529238fab705ccab0f40d41c956e074698a4e9cde772225fb35c5a294cf

  • Size

    120KB

  • MD5

    d65a48f11b5da8a1e7bc41365eb94c41

  • SHA1

    4a73e5c6b7e1b8bbf2b3b0ff9817d1f432712d07

  • SHA256

    b0d70529238fab705ccab0f40d41c956e074698a4e9cde772225fb35c5a294cf

  • SHA512

    336ee43075897abaf5ab098ad80107e9be1304f59c953c24525741d535388d4081c7cbb0770e28c50f7ce2aaacf964ddc8fdeea8d29b42e29a8ec6b41b37a542

  • SSDEEP

    1536:SU6/2SR0GfaMx8TLkCjXznv8Y78xgZ2CgD1h7fQJ8b11D6LlB6Gww:SX2GiMx0LVjXT8YYW1MnMJQ/yuG

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2