Extracted

• • Target

    9b1883ee47cf1f55533098fa6df47106b2eec5850ef20100cfddbe22855e8f16

  • Size

    65KB

  • MD5

    4b7daa34a5d7c50164ef6d86ad2be32a

  • SHA1

    15b9b6ef3aba24c3645a8e85fafbe98dd80bdaf6

  • SHA256

    9b1883ee47cf1f55533098fa6df47106b2eec5850ef20100cfddbe22855e8f16

  • SHA512

    461ab7349beeef4ee6512c50a737b2629573465e4ce0c025c97e729ea17915430a1319beeb020e3ccde987808e90efb05856e489e8c7fe8c98ebe681a345c88b

  • SSDEEP

    1536:23A3J5Tv0QvcGsi+StNpPZn05hx6cnXv7CY+CVa8j:2Q3j8QEGNtbCxjvvUU

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2