Extracted

• • Target

    8fdd9d5d7afd4a1ee7f42c4a976d52ee395099da74db3d992de844b3f057fb77

  • Size

    657KB

  • MD5

    9052493f270c74df4b073adb4ac96bc0

  • SHA1

    93bd0c5ad9a7feb96a95caa37f064a597bcc8dfa

  • SHA256

    8fdd9d5d7afd4a1ee7f42c4a976d52ee395099da74db3d992de844b3f057fb77

  • SHA512

    6f053a296c538ad9b14ad6b4d22721f4b4704a1c6306db17a0c0ed54c0a97742326e0bc03d441c9db773647181a7cba69ce64ce29f31b3069c0678c88b484c8d

  • SSDEEP

    12288:SBws6vFhIE6yS58g/zmmhIoNJJ4+enudzr3Wv:MuL/SmgbmXoLJ4+Fm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2