Extracted

• • Target

    e44fad61a261704ca4bbaa51132daea5f16abd150cc30228e456cdc8f6ff1bb7

  • Size

    120KB

  • MD5

    64f6167b0be2b748f8dcf21cf5514439

  • SHA1

    e697e1992253aad17de96afcf400dcfbe3714417

  • SHA256

    e44fad61a261704ca4bbaa51132daea5f16abd150cc30228e456cdc8f6ff1bb7

  • SHA512

    57ca9b276c995fb145c7863db8a199ae3a7c7e7c030c03deee71b189dafaa140d3673b15924491eb7804f0dbae622b1dd0620f3df4207709036162c7c7226840

  • SSDEEP

    3072:2y7Kqr6h5SD4k23QUEmEpiyFkVcQR+F0Us7OXUo:2yvr6vqiwCVcQR+F3B

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2