Extracted

• • Target

    2e4adfb7cd47a3428e91a1da99ebd372b57e17b1ef69f0c414bb91fbc15b4567

  • Size

    97KB

  • MD5

    3f031457cc756a5e86348db02ab2747d

  • SHA1

    7810aa4e305c3d3998f71cfb079a510a304fcc68

  • SHA256

    2e4adfb7cd47a3428e91a1da99ebd372b57e17b1ef69f0c414bb91fbc15b4567

  • SHA512

    791bc24d8f69ec62b677c3ca237906c83955d41de88e5ef055b6aa382e7dd72b32974f65e1540fd56b4ebf66f479a8ecc8909485fa1e1eb3f5eb03e00eef8268

  • SSDEEP

    1536:v+/RbG6ESzhl9Qiyz+MAA3135ndLA7O6ZSkOoLSNojUHzalqpT8OwAwAiL5Wf0cb:wZGWNa+s5ndLAC6WoOeUHWopTqdVWP

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2