Extracted

• • Target

    d091a892b0e1f757e8ef4d0c8367525ec118a4fdabe837b9006961faca90f7b6

  • Size

    738KB

  • MD5

    b7663ed53c0966c13421f71a7132bc50

  • SHA1

    8c95a2fb52deb4a4b0e19029e377469f0b6aa2bc

  • SHA256

    d091a892b0e1f757e8ef4d0c8367525ec118a4fdabe837b9006961faca90f7b6

  • SHA512

    17bc4d589addab68cbec5bec3cf90eb85800ff4bbbb44c4a82170d7dd0093e8b3d179d284f06b5247383470ae49704a9fea65bea455fd466563e8ba828c08aed

  • SSDEEP

    12288:h/Jm0On2dUX/jtKQPdUS1Dyex0wO2bEBWqsn0ak4Vf8N4XfMIiElTFDrhc/fr6Lv:1E2UX/jFOsn0xlilJ3u/cASJSfM7zjPV

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2