Extracted

• • Target

    e3126cf5303712618cb5086fbe579e4cb7e2f7c3976cfe8d3c19d9dda3cf70d1

  • Size

    965KB

  • MD5

    a2f62c57a418b04ad817eee901832dc4

  • SHA1

    10bc5555316b863abdb37b8326f11e4514deb2cd

  • SHA256

    e3126cf5303712618cb5086fbe579e4cb7e2f7c3976cfe8d3c19d9dda3cf70d1

  • SHA512

    36a0488ae92bf334313f0871d4d69803e054e1744cc0283df9a0104ff0d7d327b24ca8c8b0d1ecc7b3d3cc9e9bcd7aa62005011ba63f7e6afdfbbf37de5524c6

  • SSDEEP

    24576:geZtoI96g9niyvDlu+mzR5A1QpWbCzJs5TNoE:gbmbDluK1QUY0p

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2