Extracted

• • Target

    fb6e0d5db2624fa6b29ac2dfe00bb3b2f381c93bda734a7e38dda444ae2f3d30

  • Size

    120KB

  • MD5

    a8577dc41daa73c88527ebb1a096542b

  • SHA1

    bd6bf58afb2ce7ac8ede4d0ff7538df5c3fe2513

  • SHA256

    fb6e0d5db2624fa6b29ac2dfe00bb3b2f381c93bda734a7e38dda444ae2f3d30

  • SHA512

    6562701682789a7310310acecf30f37a5b9061aad04d0adb2b8bd7ab394ecee53855509e8e0cd7778ba89bb871e5b3edca5bf7ec068d8e98d1ede6e467664a73

  • SSDEEP

    3072:lSB500WXOG2FGhasWjP0s53/y0J6qcCszey5WFma:c40WXKgasWjPR5y04qcC9ycv

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2