Extracted

• • Target

    efb2150b7d17d03889a1ae7771619867a1314a92875329d68d419fe267e9cbcc

  • Size

    189KB

  • MD5

    a16cf6e2cefc42c846d0bd855c09c0cc

  • SHA1

    c3eb0af83f54c1e3a431df1eb46ec97ec1d0ab0d

  • SHA256

    efb2150b7d17d03889a1ae7771619867a1314a92875329d68d419fe267e9cbcc

  • SHA512

    137bad2bf66cf8e41c521ab5a8a87aef1f28479d605b2285c539b2c3353c83b4b194de1af813994a84504e162d563dc0bffc4fa60359b54a0ca105b517cebd74

  • SSDEEP

    3072:3cmVWY5ltbmP3Q7ysD/u9wvPUPdj0qthhBsNx1Ah/qvlEm0Lsp9drIAJeiAXECjH:smAIf69aMPdj083U3nvumw+TIB+

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2