Extracted

• • Target

    6874212815590bfb1bbc326803fccde0e944f97f0c64efb99d732fd2c5a6b266

  • Size

    120KB

  • MD5

    33eefeeeee7a0c1ec6e6b4c372bb2954

  • SHA1

    358d8ddfaa771089de3f349af23f7c59f1f07501

  • SHA256

    6874212815590bfb1bbc326803fccde0e944f97f0c64efb99d732fd2c5a6b266

  • SHA512

    da60f0a1bdc942ffd1459566b537e1bb9f04988acbf0e2a87589352b785e3ff898827e481681a2e19dd9a683f7bd579f52324cf840ca9b2cc970f040f5603653

  • SSDEEP

    3072:VxZrflgw5uUC9yyUcuK2/JNQBjRDL4Ti9:VxZrjJBcu1rQBjRDL4m9

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2