Extracted

• • Target

    017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e

  • Size

    657KB

  • MD5

    6a1304af0bdb3a90423021ea9b607f31

  • SHA1

    b3a8fea4b7a35a5e2461f261e05148481aa19443

  • SHA256

    017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e

  • SHA512

    79e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576

  • SSDEEP

    12288:iARDO0MVcRoSK6wTx9/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeen:pDO0MWiTx9/eeeeeeeeeeeeeeeeeeee3

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2