Extracted

• • Target

    8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93

  • Size

    120KB

  • MD5

    ee1f286e46586a772ca9681eed89c081

  • SHA1

    76f296b46d24a3156b7e18a4d5b1af2d465a7730

  • SHA256

    8b87367c0e549eb29516edb1d45ab2eaa9060036ae2376a2c8b7e33fc38b3b93

  • SHA512

    41ac747e54dcf64cc71d21a9991a7c4aaddd23457456b94ab30831f59833d2047fab1aa500b8e89cbfd440ff9cacfdeda7307ee41e1116badb42321bbf121886

  • SSDEEP

    3072:VmoVwkRKC2sU+1VC1IEoiKtmYvvOIP5q7Rtm0/iE:0oVfdPtiSY0PSmi

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2