Extracted

• • Target

    9a49c9b6af34a5ead16edd24fa09f5307fa459d03152f4783761f1563d1b0b0b

  • Size

    100KB

  • MD5

    337cc4a34cafd9e01d8f78cb258191dc

  • SHA1

    4a95164663933e6d26eab486212c7fa718e88741

  • SHA256

    9a49c9b6af34a5ead16edd24fa09f5307fa459d03152f4783761f1563d1b0b0b

  • SHA512

    7a1d1bfb4158edd818a9ca9b8b1c9b18c85b8156ee2284a21adf4dcb641cb41723f14491dac6b2b4ccf6e2d2be791c17d4ec2432900aad68faace10fb66f1d05

  • SSDEEP

    1536:kUZBy4CdeeYglG7L4o+7V0IHZSetH0o/W1DhCt16RiI8JLDIoFxjLI5:ke/Cd4OCUiegetpWuz6Ri5JwKI5

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2