Extracted

• • Target

    3a203f9716cea0488edd92b75d1defa9807e89a2b06df87bfa26e5f02e6abba9

  • Size

    100KB

  • MD5

    076450151ee3aa3bc8556695902182ff

  • SHA1

    e1fb49ad2e9b927238c2a4a32b5f33ce1b04a3ed

  • SHA256

    3a203f9716cea0488edd92b75d1defa9807e89a2b06df87bfa26e5f02e6abba9

  • SHA512

    e2abb62024d8d56e4066b85f800b5b4f54493e0b34b1c03aa57745b54a73882abfabb5a53b7f67f1a61bc52091a954789d542da45ec357be2ea1d5e8ed76ea26

  • SSDEEP

    3072:H8kKz3I8rOJLdkzhj3rzGrKX2q5CsHK69LKz5:BK83JB2fzGrKX6/69GF

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2