Extracted

• • Target
    fba9ba470fa3ee3054a7bf1c7c9bb61ad69515440ce6c7c82b7611ef64e337d6
  • Size 7.3MB
  • SHA256 fba9ba470fa3ee3054a7bf1c7c9bb61ad69515440ce6c7c82b7611ef64e337d6
  • MD5 4748b2bae9a8db690e81463037c1f27b
  • SHA1 5e96281937a25673b48a19eeb39a21639132f4ab
  • SHA512 137a316a917ad87dcb107e81e344264dfa3da6963c6304854607384bb3b19352a69c4a843f6cc8b8f9bcea8ee512e2cdf3d20e77f196ad06296d04dcd6a02b70
  • SSDEEP 196608:PSLXj5Pm7MXZ3w8A39xHv4Voy+SVVkQNri7Jm9mA:KPE7MX6zsdVVkx7Jm9mA
  • TLSH
    T1DB760293715845A0CAB9993CCB3FD8F730BB2C2D9AB0D56E66F9B79B13312D0401B952
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2