Extracted

• • Target

    b8b3c2265d4ea572436d0fbc97fb58d8f63ce15c7a9e00548908252a4a524191

  • Size

    100KB

  • MD5

    7a7c081471f7680d05540f823e1fc256

  • SHA1

    91100d5aaf58c2757d35d611bb9c3dbbd9cd3644

  • SHA256

    b8b3c2265d4ea572436d0fbc97fb58d8f63ce15c7a9e00548908252a4a524191

  • SHA512

    d68edd439a0307f82ad416a9683715b1177922cb55ae5ca4a052863da8d63f7f864f506bcb68b12d03f89cc621748ae49d7e829dcfba717e8a50aeb21ceb6a1c

  • SSDEEP

    3072:N9EoZczdgQ5QiI8IcT3reftz8MOsEwAGDp:F6hgHzaCNEwAEp

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2