Extracted

• • Target

    d0f666e1e38bff5b2838fb9335c369ac4fa4f57ccc4a63efd1441e3e4093373c

  • Size

    100KB

  • MD5

    82fcef50b0df1ecdb50910f940a183c0

  • SHA1

    08ab40dbcffe1a979940f0dee935bcf110d88ec0

  • SHA256

    d0f666e1e38bff5b2838fb9335c369ac4fa4f57ccc4a63efd1441e3e4093373c

  • SHA512

    3b450227aaa63a52db48c7c9c2bb24bcbb792ca9cd43e1e8f4c380c21db8d340d240668a06fa7a2d6605513607d27e8386a974b4e9a67a0c8bf2269c63fb8f06

  • SSDEEP

    3072:p3ZXtnNChjoWclWtOwrQBJoRI6lvm45bK3C:3ZUUWcliPQBJ1N45bZ

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2