Extracted

• • Target

    2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122

  • Size

    120KB

  • MD5

    24d585773a8555605d1481ece19761c0

  • SHA1

    29f5b8ea6bb52f031211e7a11e9a5e524e074927

  • SHA256

    2a69a162b1516b64ef3ede25f5ef38dcf4b496f742988f1876fe263b9900c122

  • SHA512

    75eb95d8164142519c3f98813c822f4778e7f98681656336ae2fccaa8bba5f1896084b3ec11e38fb7e084c182d029a3787d8a5f62c8548787759b9346a334760

  • SSDEEP

    3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3:UZWwYvsmO9X7Oritlh+UWIdc

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2