Extracted

• • Target

    795b87bf96302dfcbe81b28d6bda4c35b3cad4072fae87ce541d94dbf3b6cc99

  • Size

    100KB

  • MD5

    6fa84eaf324145099edd06cc62732423

  • SHA1

    5670d9b7bf0e409281ba2dced41b2cb4b959dd34

  • SHA256

    795b87bf96302dfcbe81b28d6bda4c35b3cad4072fae87ce541d94dbf3b6cc99

  • SHA512

    bc4e4e788a97375341d1b4cf4ea2f0e7ab4346b4ddc31322bfff17dfde5ea05f769929aedc297ddae18d3f42edd27eae29eb2644ad3555ad15cd11c33ca1210f

  • SSDEEP

    3072:rMxFwT31EjUCwIAAKpYixpH+wrtHRAZuOQ0v:aFwCjnmEixpTr/guO

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2