Extracted

• • Target

    0683c323ea22a6268a6efe58f4fdf50873f4e3ee9eed266fb96687b516feed89

  • Size

    249KB

  • MD5

    0cdfb9583eb10a9414b72e426bc48633

  • SHA1

    292a14bd146f499e82897073e25deef896e42929

  • SHA256

    0683c323ea22a6268a6efe58f4fdf50873f4e3ee9eed266fb96687b516feed89

  • SHA512

    ef4504169126709f8929dc497037491d03a99bffef21a45cc4f666af946859cf1e73c94a1c27c902c458232c7209d327f7906a66c3ac9b9830b0100ddc735544

  • SSDEEP

    6144:UNUEUNPA3Skv5ZcfRG+eC+DCtLhXK68udbUJ4xZA6:XPAn/yROC+etLhXqEbUJo1

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2