Extracted

• • Target

    0a6544be5b35b94a54d73515f68729dde957c5fd12fba77985fb50328bf95f73

  • Size

    265KB

  • MD5

    08f1e40abce2af9b41c843e4add48510

  • SHA1

    9ffedcb4555c4c2db3afb2e754454aeaf09ede87

  • SHA256

    0a6544be5b35b94a54d73515f68729dde957c5fd12fba77985fb50328bf95f73

  • SHA512

    a9d6bcad1f97b6de1f9cb4182d832ddf6f5602891b15c6510f56bb535e0cfb607b5b92f5d62480579e8df8c52b67cc6a0884141c66c90fed2a3606a2da63b06d

  • SSDEEP

    6144:ELHSh8WmsN3jFQedmjOjn1MMH7MMy117/Nv5sSLcIUPvdEcAz:Eu1mkjFQedZBMMbMMCNRvLc5PvaR

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2