Extracted

• • Target

    fa30ce0b2a6b2eeafed0e83e1e3ee9b3bd715e68c5b8f65ca77e197f7238f908

  • Size

    149KB

  • MD5

    b969c59c154a59458eb55e1d6848e86e

  • SHA1

    c4ab3a041bc670dc216d938f99bddd53ba0cedad

  • SHA256

    fa30ce0b2a6b2eeafed0e83e1e3ee9b3bd715e68c5b8f65ca77e197f7238f908

  • SHA512

    bbfac9ac8a4101f9220e7079d132b8e4e83647c1e3557d1b8a2d4ddb48c394003f8472432b22cf2e88b01b36d1f93f6e75873da7523964d33095675662a6c82f

  • SSDEEP

    1536:ElU0biBKD1TEFQXjG8YitJrniKiO7UZNpBIGMgB/tQcYcA6Wp21XBKcSmE/HXqUu:SUMfoQXj/tJriY7Gnjptt1b4m62+JJv0

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2