Extracted

• • Target

    2a8d4c8b787251c07326e18f3b3d4a6d6516bc5567b1ea6094ed3d5d789d0825

  • Size

    945KB

  • MD5

    0504aa47c8131965eb8674007705d930

  • SHA1

    c2180459799c8951b26abf7cf1de6dde2794dc8d

  • SHA256

    2a8d4c8b787251c07326e18f3b3d4a6d6516bc5567b1ea6094ed3d5d789d0825

  • SHA512

    30a87c2d38365974d1957d4f66c929ddaab25016a2a6a1dbe0317273eb62174803a0e62519777abba959be51b9d52ebb30cab7387168a944a7a814d49749f880

  • SSDEEP

    12288:gkes1Sqq4bwwY0x2P/WX85447/AQjpcVJqs0h9v+OqDGETstHs+gnF/a/xjrx:gk51SqqKwwYt9/AQvLvQaETKgF/+xjrx

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2