Extracted

• • Target

    f3b3e4ba7e399127fb40b58cbdf72f98b906fd43f0e3162898eaf03ab05eb5a7

  • Size

    347KB

  • MD5

    4addbf039078b57a096cd968f050d900

  • SHA1

    33d03bac1abb334374234dc6adb1860201f7ba11

  • SHA256

    f3b3e4ba7e399127fb40b58cbdf72f98b906fd43f0e3162898eaf03ab05eb5a7

  • SHA512

    06c231f0975bd36c8c8759ee7cef81d7de1b9d04898b031b43572c7b2d8269c15f51d6837aaa25da09de76d9fbd31603438522e026278a7da7c654ebe2223212

  • SSDEEP

    6144:sqHGoq/TMMFIgLYW6E5vmCTucxSbnc1u/RfjZC9/dBd/LA5oERq:s4dNMFIkP5vBuVdBjgB/2q

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2