Extracted

• • Target

    1d04f9e7bc174c0c3ca1cedef81c04ed93bcb30beb6585be4dbc274aaa90c36f

  • Size

    564KB

  • MD5

    0f2892e40e25a8fa6b0a6ae6b5392720

  • SHA1

    054835c97ae6552aa55967423f1dd5ed52f7e5da

  • SHA256

    1d04f9e7bc174c0c3ca1cedef81c04ed93bcb30beb6585be4dbc274aaa90c36f

  • SHA512

    bb2b323804618f2be319f7227b8cf7b540682998d61f9b224e7f73ad00cb4da727568387072cdd6836aeb68ce522a62016548e03c9a5971865254cec78961f88

  • SSDEEP

    12288:xSK7AjmRWIB5DpO0lXwtpBSPPmdMwAS8J+cyOcBu0PAlO+ZiqfynGRs/bX1+f5r2:xSbjmpJpOYwtp40Mw8yO0Al6qfyGRsjZ

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2