Extracted

• • Target

    5cb9232b5bfc8eb054dd42b877fc95454e4c5065f97b1e042053d95e91fad374

  • Size

    100KB

  • MD5

    90023af04f95f3144faccec4e8882db0

  • SHA1

    32f41e3c4a56e8fd9935088125394ec56264f7f2

  • SHA256

    5cb9232b5bfc8eb054dd42b877fc95454e4c5065f97b1e042053d95e91fad374

  • SHA512

    21826f898bcfeeb0464014435d5eaab4ab53e2ca8daa29484d1be0ef9b66b024c360f80240134c0121223004fe43795079bdebdab9b07bd2c604714a6a119190

  • SSDEEP

    1536:PGHCWbt+z6VSPOFNqC76qDB9zT29K9jdsbaJo23:OiOcOQWFNP6IHT/AbK3

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2