Extracted

• • Target

    6d94951b1f904864f555cb85474cd7e731e380e153563d3ad2fa832686f34ad8

  • Size

    65KB

  • MD5

    91f1a0afe1f295693e9046aafb8621b0

  • SHA1

    12fb898cccf157b43f5bee0d211f539c55037e2c

  • SHA256

    6d94951b1f904864f555cb85474cd7e731e380e153563d3ad2fa832686f34ad8

  • SHA512

    996101037c82613153a35998ed4f9b5b8a77892797c9df6432bf0b33ab5988886f51cc8d1811c315b3382e2e9dc0fa18e2124c814de02945d0c0c8d64c019183

  • SSDEEP

    1536:PiynNhr2MozN5RepfeFRLxpCzC0lERYAoOhMXoR/:PWzN5cpfglEe0CFoO8oR/

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2