Extracted

• • Target

    841de1f5c8c2d76cca216ef09cdffd6213b23036bbca333fa6f1583fa462460f

  • Size

    330KB

  • MD5

    6d6360634661d5db40aef0860f5b5e30

  • SHA1

    cf049967e59740fc8c19437fdf170efc75262407

  • SHA256

    841de1f5c8c2d76cca216ef09cdffd6213b23036bbca333fa6f1583fa462460f

  • SHA512

    231b3aa6129ba3ce943a68c056f0b04a58e613f2508086575a64aa01cfe83610deba044cc541aefb73c9f6ddf87b783e333a328dbe9d6e30e332b3c76f743c31

  • SSDEEP

    6144:aeg4gCEHe2+e9O+eGZILNd5bUpziOoymU7FIVaHUXEoFN25deJ9wS:GCE+2+wcC2E5INrNYeJ6S

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2