Extracted

• • Target

    d0fe3af1f81619fcd632d3c0b42ecb97d5dd6e26608de7c4cc736b7fdc78ec03

  • Size

    3.3MB

  • MD5

    694c193b2732dd7429da83529d52d8d3

  • SHA1

    a39d8b9398bd1d2c4547d3164b050ce67608b3d9

  • SHA256

    d0fe3af1f81619fcd632d3c0b42ecb97d5dd6e26608de7c4cc736b7fdc78ec03

  • SHA512

    e988f2a18655390892a99043944994c44891d8db8d0d7ee5f1c92e2e005d79c5e20d88aae2d9eb245608ed1ee4f3f956b1715f7b7d69d734d42f46795da3c48b

  • SSDEEP

    49152:Wo64GpSbFwnXL+n1OEffvilDyVffA6ra5aSCq5uaKfq7gdBAoGq700TgoLKG0nlS:Wo6JpPL+nHffvOW3AXfaq7gdmuz/5aA

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1