Extracted

• • Target

    88d23ec88d03cf6d4e564b73834560b32f2d56220ef25cae28d04edfe0112488

  • Size

    486KB

  • MD5

    3cdc2d619569452fff5184857a7a4b30

  • SHA1

    9caef5764088dae4d2700a469cf78f938c57aa9a

  • SHA256

    88d23ec88d03cf6d4e564b73834560b32f2d56220ef25cae28d04edfe0112488

  • SHA512

    fd7748f114a2cc9100bd7933ee835ce64c84677cf84c1764b5bc66591baf3d0d7c32add928b3565ab0b8096026abc69785d1646e4048211eca37c4045633f305

  • SSDEEP

    12288:EMu1xxPb2iBlBqOLMwNr5AmU91315a4p8Nf4QsYVx:y1x9Bldt5ABz1w4p8NfLX

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2