Extracted

• • Target

    b54ca40f333d7c7d294b331e3c10679cbd33f1400313a3e39db58eb7c51dfa1e

  • Size

    120KB

  • MD5

    83d34a3ab32c1d22da00941795249d52

  • SHA1

    ce34e8e47215d26a9d05c4683d6560d39d101e54

  • SHA256

    b54ca40f333d7c7d294b331e3c10679cbd33f1400313a3e39db58eb7c51dfa1e

  • SHA512

    b0cbd09cfa8c11f9323eb1bfce2071203eb4761ad0a4d5dd965c4cbff200897e761fa89d50369667c4f41646f8e6ebeaebeebd5b07945d4dd3024a769521adf2

  • SSDEEP

    1536:3pV2v+AyR26bh6u9bBvPfbZPwDeyjs3Gm0Q9J9tFDWuMj3CjRri53fkyvtEVFWuO:TymP3vPfbpwDnVQH1SWE3xI9Cx

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2