Extracted

• • Target

    6ecd8a0ad689cc8306f6d5de4cac5448ca8a33b2f0f3920f6c2dbc507290ce2a

  • Size

    96KB

  • MD5

    039f86af89df1dc16e2802b00006aef7

  • SHA1

    b8278726c0d3722c4fc766df8f7f1312d897869d

  • SHA256

    6ecd8a0ad689cc8306f6d5de4cac5448ca8a33b2f0f3920f6c2dbc507290ce2a

  • SHA512

    b75954e109644cd9bf0196444a9833e0de4a167ed4179547dca04df2d41b376fab789365a624514d36ee2cd50863d66cb313c57079c0efbd19421ec741e6e3e9

  • SSDEEP

    1536:99+rXOFfiwNQl4YpGZeI3JW/cbN2v0/zIXXx9fLEMYoKmBHDBGUJ0e1G:T+DOYl4etI5WiGEzIX/fVYUKU6ew

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2