Extracted

• • Target

    5e5bcb6141477255cc1a6aad8e61c705ae9e9b31c31e4a99e671ed2fb11c67bf

  • Size

    100KB

  • MD5

    72ca6dc575f310f1969da3293432e52c

  • SHA1

    c637ee3d85cbaadc8b95b09ad2bec7c3f2fb70cb

  • SHA256

    5e5bcb6141477255cc1a6aad8e61c705ae9e9b31c31e4a99e671ed2fb11c67bf

  • SHA512

    b0bee80cdeefed8ef9d336ab569b3c3c7e408a3511a8a61e041eedb96937601a95977a99500f370cc2d2a76a4ffd98ac4c59303ffdf095ad3be40fda06789fb7

  • SSDEEP

    1536:JqHngvI+7U27Rue06XePWb84MVmqDoocnS1yzOx6eoiuD8BRwlCumbtCBeF/fAQB:UgA+A9h6OaUm8chleo3YwIbF3zVK6

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2