Extracted

• • Target

    cadc5722ed4e2c2b0979f023396ff189bc977914ce8c4276229bd22858afcb55

  • Size

    100KB

  • MD5

    8505e386ace5a4853094cf9562eb1223

  • SHA1

    2895d2a28f332bbc64f6aa85d2f370d4e45cb1ff

  • SHA256

    cadc5722ed4e2c2b0979f023396ff189bc977914ce8c4276229bd22858afcb55

  • SHA512

    caf5045b914be544402a15ac24e644a261b247e8c075ec6dc82210607a2f7e3605058cc7b73c9211eda6ec3130271c8baa555d0614a61e62e3ea162e77293a06

  • SSDEEP

    3072:Zzf2MedF6WA1yYRP/mij9OcSdX/o5/AhLMf2ctX2:Z65dF6jzRPBMcyX/o9KMdG

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2