Extracted

• • Target

    98c85835fc1122f7ba8d8f72d9a8d55eb82a7bbd71d1012f6aaeba691005c683

  • Size

    100KB

  • MD5

    1ca9565385a989cbf383130e351f3ec0

  • SHA1

    759efebd75d67f10666c2bb79ba1bdf43b9e9ed1

  • SHA256

    98c85835fc1122f7ba8d8f72d9a8d55eb82a7bbd71d1012f6aaeba691005c683

  • SHA512

    f7b72a1e44250491acfbc1f2b80de52ed68624dcdcacc8b0b976b7017ff1a583c9ac434f6e4594b5fb2d538070b6e5f31a5d4a4fba1d93b1120792722154626d

  • SSDEEP

    1536:xC3PlbL6znuWZWBa9NxMv0CpbCrgJSx9yYeGU2QgDU7OFVxjztqM:0PlbLEnFPNxMv0CpGJReGUADU7wV9R

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2