Extracted

• • Target

    9f34ffab4a7c5ddb3e2bd7af02d1e605d415fe000ac5293de98f88ba582f3fe2

  • Size

    476KB

  • MD5

    5c6eec2e1803be0b0e988e79c856a110

  • SHA1

    7e010f6a33aa16756dcd709ceb6b6f9181d61f97

  • SHA256

    9f34ffab4a7c5ddb3e2bd7af02d1e605d415fe000ac5293de98f88ba582f3fe2

  • SHA512

    fbc02761f21ede6d8f1386d556920ca37d32036c810483e647a914e5cd9cfabd07ee1a0e498c90d1e80818025640ec31d59a41b64dd6796ddf75cc3b03af7130

  • SSDEEP

    6144:jf9Y2ofttlhY7g3S9HldGk4s/ZIpk5iuKmdIKhBcdXKVhx9FA:jf9YjrhY7g3S9FzVh2dXKVhDFA

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Drops file in Drivers directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2