Extracted

• • Target

    b00670e9150ce36fc88527423fcfa9a8e2840d3308d9caa19384ae72407c4274

  • Size

    100KB

  • MD5

    a209e1f248bfcbb14fd96155f10b3988

  • SHA1

    622563336bc00d670b7e7ee77ec90a8155bb9cf2

  • SHA256

    b00670e9150ce36fc88527423fcfa9a8e2840d3308d9caa19384ae72407c4274

  • SHA512

    1ac2aa3391668cbfd02ce0d9452d23103fe2677e1b8a3afc9ec6b9095f674f139adaf26b38d90f2bc21aef9f2f35cd45ecfe22dee92448b0f509e74be3e98455

  • SSDEEP

    1536:CA21XgTu5/5VvATcN9OuPoqe3B8f0AeSasnrF9kXyEa+iUF24eD57BiUfV:F21QTM18oPe3B8iMJaGN57AUf

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2