Extracted

• • Target

    2209e54e3813dc6f64f1ac1c4da7aa2ff3c440361683eec7a03fe439f2ee7fc9

  • Size

    97KB

  • MD5

    07a4b91c5fdca0bd9d7c7ec5718eb4a6

  • SHA1

    fe450d36f90aeb06da705afdb49148a0571a9acb

  • SHA256

    2209e54e3813dc6f64f1ac1c4da7aa2ff3c440361683eec7a03fe439f2ee7fc9

  • SHA512

    c100e4277505e7eda595c755cd07f8e0ebe44bb4482b67a7a1dfb37e67913324e103ae460fe000eee57dcace253a8764f2ad088c90a47eefad5392fad5760376

  • SSDEEP

    1536:5QvuKg+IYxNnyhXZykW9wyc7YjprJWlr4emFFPtPBZYYxu/L:5MuKiYxo349XIr4eglZZvu

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2