Extracted

• • Target

    ea7900bf8be6e83c8dbf8ca407f596c67d41081efbef85610fb503ee10988cf2

  • Size

    120KB

  • MD5

    3198d7e89c5f6161d3cbd2aa36783f25

  • SHA1

    e14cfbed9bc4e163b335e8aa935bb5805a9f823e

  • SHA256

    ea7900bf8be6e83c8dbf8ca407f596c67d41081efbef85610fb503ee10988cf2

  • SHA512

    1d7f4af10badfad2856a18f2431c9988fb18f82aeb1e80ac01401f221f6b499329bc3bbfa3fb5856810c43b76ab4b36eb2ea8f84c7b909db63acda4d615ed53b

  • SSDEEP

    1536:BOYM7u7qe+Bsll6IOtoDzlKWJir9nR/TVYQiqELA+VNvTcvxSRi5LLJ:YYMFe+Cll+tMwWJUntSQixs+V305X

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2