Extracted

• • Target

    a2192a2df9f1667345f2c80325e85f05b1131348400692a3c8a0b46913a3ef90

  • Size

    1.2MB

  • MD5

    4219a833173bfc883d8bdb652c00d200

  • SHA1

    5a6996414ae334dbd41c482477920a9dc9c5feff

  • SHA256

    a2192a2df9f1667345f2c80325e85f05b1131348400692a3c8a0b46913a3ef90

  • SHA512

    40e0b8aa99682f2074376cc6e174b04bfedf758ff8d7fdc94fa27d826dd32eb2f8776f4413dad941f2d5b7968604a721ca52347f48e53c05e2b693dd3e69b229

  • SSDEEP

    24576:RqSZJUz8e5uyo9c4siUPWc3EWTYPsyvrNFIfy:BeK9YqeRTY0Ur7sy

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2