Extracted

• • Target

    01a5b85ed8fd9081b1cf0375a92e20fc5608f392df600f1a697a769a3f965551

  • Size

    97KB

  • MD5

    c2d8833aa37fb31ed42dec32c28df9ea

  • SHA1

    66421c7378c66ce1fb416bbaf40bb95aa0dc3132

  • SHA256

    01a5b85ed8fd9081b1cf0375a92e20fc5608f392df600f1a697a769a3f965551

  • SHA512

    0f2a1dff5fb54b919dde41af6f15e33d623af9c8c2249d323b51d6733fa844a384af7d816b68cf5fd99ceac654981b1214b370caf4f4cdfa2833975d98c0d2ea

  • SSDEEP

    3072:ZqKgIgtuQE7YGU6vOyQAnnP0oL3LITPMG4GrFO+:YcquQE7TU8Ofc8oL3LwrFO

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2