Extracted

• • Target

    62536399a258eb13a4f8161c97c9a8679ef1196fb082c6145f3f8c46430b361d

  • Size

    100KB

  • MD5

    6547a40fceacbf4966a7d3e1291b9c55

  • SHA1

    82b90437aee93ab7e6bff60c5d510edc1458a3fc

  • SHA256

    62536399a258eb13a4f8161c97c9a8679ef1196fb082c6145f3f8c46430b361d

  • SHA512

    4795498dc9ac709e7f7eccb84827847deb9f01c09485463181d39b89d23bbdcf8094f6afa2e50b8cdfda415a9259eff76f54401451f9426eeb5bf8b34cd7a154

  • SSDEEP

    1536:zmKCjr6mQTmD0SUo1T4LWf/DOpYUV2sF56OGFKcuR64OLO77HM:zmyDHol4oCp5FkORcn4OLOP

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2