Extracted

• • Target
    558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7
  • Size 681KB
  • SHA256 558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7
  • MD5 144889fb4bda04f0a91dd3c8c7bb4fc8
  • SHA1 c29031ed4ec79289a98f3e9856931a5378fcbe64
  • SHA512 8548385567d044bfe1a529798c35b995e42c56318f9d8e3a1cc02d5c7a2be877aefaa6ef470d3a839df8a3f7413a0b8613bcc111dc978db51e2f5d237f839100
  • SSDEEP 12288:1zG7FsZ3uUyMhZpRDZEJUDfAVgGjTgrJ7X4f4RGv0Xx+ZENucupH:1S7iZ3uUJZpR1EJUDFGjs174+x+ChuF
  • TLSH
    T1CBE49D223A41C13AD9B212B14D2CDFAE516EFD710B6219D7A38C0B755E644E27F3263B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2