Extracted

• • Target

    517cdaaa3861ba528721c1e19b04157cfe401e4bc93c0755d1c65b18bf8b4f52

  • Size

    97KB

  • MD5

    0f393537461f6d0458fe826cce728516

  • SHA1

    df72a54efa6f837fefbc4cf1c20311d3b8ba4fd5

  • SHA256

    517cdaaa3861ba528721c1e19b04157cfe401e4bc93c0755d1c65b18bf8b4f52

  • SHA512

    88d39a8f85a1cd22b323daaac5b6ba49204447f940bd88554a4795c96ae497d904875479858711094da038207fa2975dc49e6e200bd33572ff02afb1e36769f9

  • SSDEEP

    1536:5G86dCUuK6/Wcb+Fd0+H+D26JADs2zqqFxZuKEguJxTfO1ZGvVtW:5G8VK6/fwPeqFyMCFm1

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2