Extracted

• • Target

    374b17dc1f431a8ddb68ca00276747536569f7b0447b56479d1baf00f5ed4a7e

  • Size

    100KB

  • MD5

    51e1708a42b792e339d3ed3654b2dde9

  • SHA1

    8c6fcf3eda4ed7c1d1bdcc980dcef7cdb86d7626

  • SHA256

    374b17dc1f431a8ddb68ca00276747536569f7b0447b56479d1baf00f5ed4a7e

  • SHA512

    de7a3de10446cc453c3e6bf858a463d979b16b3d27d8298022d824548ff1c037e65c3ca9598a95d5c23186ada7669e7abc7265a2739b777f61f9dfd053c6b6e6

  • SSDEEP

    1536:TclxRw/2D07Nef4e1JREs3AqKEnLRYrOj6KVuoRIeWNqn2vSC1kyhJ3nY:TclxRw/2MTULR8ToRIeWYnsSCKI3nY

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2