Extracted

• • Target

    34e0cd7282affc0f2aaea312f0aff75ce5ede691667ede8b1ed6c53911d5718b

  • Size

    65KB

  • MD5

    3f5cb3672604d129919ce001723f79a8

  • SHA1

    d082e409aaa21d9c878bf7d6dd98f069ed13b7ac

  • SHA256

    34e0cd7282affc0f2aaea312f0aff75ce5ede691667ede8b1ed6c53911d5718b

  • SHA512

    e6e601eee6190e393d5ceb2acb3ce5b488b37cf0d201447a5efb35da7388ee71359552f0d1550aac92a49e8e06c2503e9740f8f6fdf0610a6c54fde3d0bdfb9e

  • SSDEEP

    768:MaAEHyr3zPzbhB1cBDQ5e8ydIlKE3r94bEvYKoG8gzs/phw+UusxEfYeInN/cpJD:Matyr3Hn1cV6v3KEmqshIEdIk8b4

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2