Extracted

• • Target

    7d52223429192ea73989ff622bb8495f2c1ecdd8e757109c16abf6b8c3aa87cd

  • Size

    100KB

  • MD5

    09c36ae1b64ae4948c523a605af23af2

  • SHA1

    8f69cb92cdc4391c49d4c6cdcdf5b3b85a09d797

  • SHA256

    7d52223429192ea73989ff622bb8495f2c1ecdd8e757109c16abf6b8c3aa87cd

  • SHA512

    af2fb207e85c82ac38542e49afbb111e562f8d90c15715dfbdc21c1968e63feffcf559304e8c9288b6dbca5fe431a40050024c0f1f1d037f1dcdde39913d3dbb

  • SSDEEP

    1536:8Z+Dgi2YJQeenkoz4Fr5Ls5qrzcuFWnUsKr1zneQiNr27XSgnnzA7bk23I:/0i2YGeenknrlUj9nUpRGru1zAzI

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2