Extracted

• • Target

    cbb2ffd6d27e7ee25767e7807aaa6683ace7be4ec0eb86e42d3a7ef3fed7c99d

  • Size

    120KB

  • MD5

    2b45a708914f6bcf5aaf92d460ddab2d

  • SHA1

    8097f3334ee781c4d6a048b80f85f8d40a36453d

  • SHA256

    cbb2ffd6d27e7ee25767e7807aaa6683ace7be4ec0eb86e42d3a7ef3fed7c99d

  • SHA512

    c293ce3c50c8c3aa45cba6aabf0cf8d9388b2260467b8f84e4229c37557ae84b9d788992b5bc5687ff0d77e32791912a804b37db332dbd02b4cc4953555b2d43

  • SSDEEP

    1536:qUKNyxOfrRDa31+1/l7OFveCzX0FUXAZVGYfynkZ1yhRCyU+g020RFdl1sh7D+RE:VKYxqZ0+RcFmC4ZbK8+RCFTwQqxkHhr

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2