Extracted

• • Target

    605cca9676d75e408ff6dbfd78f9d2cf41f1685e48a12bd5e9ccd6ba75d3a23c

  • Size

    120KB

  • MD5

    d7c1f4613b34c0aef89e07337ce0e3a6

  • SHA1

    08b5b367442056a9ccc11a5d4ee1e6b18cb38a85

  • SHA256

    605cca9676d75e408ff6dbfd78f9d2cf41f1685e48a12bd5e9ccd6ba75d3a23c

  • SHA512

    9159d3ceda24f5e5f74c92405ee8d1d58b3863b6f5900d970ce9dd928f48639ce370e0232fff478548ee4214f778c5a824aabac5d18f9261fe12797791a28932

  • SSDEEP

    1536:0hOcAoMGbnHGLEhVRcLpnKGsajI165jg/bpCahblGi1AbEIVfEgmzQRC0:0hOc/MmHGLuVWds6cDloi1MvFgQJ

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2