Extracted

• • Target

    cd784c1b6c25c7f350a0ca90a56688b9ed7b24286b149aac5f46b1afa3556392

  • Size

    120KB

  • MD5

    37128b51773ad5fdf18d869dbfc8cde3

  • SHA1

    056852825c736a8805cb5b8d3fe53f5f9517e97d

  • SHA256

    cd784c1b6c25c7f350a0ca90a56688b9ed7b24286b149aac5f46b1afa3556392

  • SHA512

    992deeef9fca2a4fc5d1ac03e68dd56d924683ede80f308463fcf79cb1e458593e8a7a058983e079eb37867c2897c65f6aab7315b990f4bd3deb4d9be7bbcc0d

  • SSDEEP

    3072:ulYeETe8dGRrSQqpcMSiVXwyejynJi23pLZ5n8:uld8e8dGZj38XwTj0zLfn

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2