Extracted

• • Target

    72b3a5485fdfc16bdbc6a3542cfa6fea00370ec0a8af6c65dcd53612c5d02fbb

  • Size

    120KB

  • MD5

    f8148311f1774ec1bdd987061cd6522e

  • SHA1

    ff9a2ca98a11335c41e4734b7553ebffa0719f5a

  • SHA256

    72b3a5485fdfc16bdbc6a3542cfa6fea00370ec0a8af6c65dcd53612c5d02fbb

  • SHA512

    ab24b52e80b8f7e7cbd0956952a02f18a385d9f2579452904da634b5779876ad3ef258a08c98bb0870c256ff17ffefdf0e6bd2fc12e1b7fdd0f1ef416bdc6db9

  • SSDEEP

    1536:06hjYpQIhMhGR+SXgFSACUw7fkvXT9urmAsPrbfcik0TUXPoYDRZii63FQM9YC6:0KkpQE6G/A9YiTo6PPHjkGqDRgrrf

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2