Extracted

• • Target

    a33a251c6c2d5e609db653a802eb24f3e553a0cc176ec3a8e08f46669e41405a

  • Size

    65KB

  • MD5

    71734a8b6d84f1498f8c624164ed3880

  • SHA1

    f7cd9b54a4567d71dafa3517fd7e4e41a54b9505

  • SHA256

    a33a251c6c2d5e609db653a802eb24f3e553a0cc176ec3a8e08f46669e41405a

  • SHA512

    d88d41eba53a389e8934a55b5c369c337cc6c5fb04522d2d946eb2545907483df14b8ff015c703ea013e0785c726bacb70bd25b6b7e8ceb18771a6baed73b860

  • SSDEEP

    1536:FtIZRIon0o+/xei6UFT4oZjnw3n3+lIl1yEp0HaQgFsm9kUUxR:Uxzoxeifznw3RDpFQ0shUGR

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2