Extracted

• • Target

    a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5

  • Size

    120KB

  • MD5

    eb613ca57258709512eb1b147f253047

  • SHA1

    edf7e064c1f753a4913f2ef3622f4fb8b4aceb80

  • SHA256

    a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5

  • SHA512

    344f030b582f111f3b060eff86e15beffcf5c60b766ef3653c1cea9f3e3e28cfdc96aade73fb9f0fcd58a35af7d09911f89d53064ee57a4bd7690c66a0e0d31f

  • SSDEEP

    3072:Ak2LhALW38jLP/SlieYjXN+BlQIadxUNT:p2FAB2l0h+oR

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2