Extracted

• • Target

    74790fade64dceb61837ddf671d621d156364e06c3e55eac183fc43e19e2d962

  • Size

    97KB

  • MD5

    074256e7cf5d95e56a88663c73d4c390

  • SHA1

    9a34a888872f170763f7d831cff711f0cd49f1b8

  • SHA256

    74790fade64dceb61837ddf671d621d156364e06c3e55eac183fc43e19e2d962

  • SHA512

    76ce67614a27ff59fd3770a6f05feb9eadcf73d15e01c0f397f6f05d1a5f8fb763dff017ed749025bfc4895fa54ec7aeb83449d78f1dbf81afdc4fef550344c1

  • SSDEEP

    3072:jB8LpAyirl7rQtizNn/K65l0uNF+7XVdBi:37r4wPfcXrBi

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2