Extracted

• • Target

    7657830ab5db762cbec824c09e95580b48945f7ad120502d8211d00866d4ec19

  • Size

    506KB

  • MD5

    29e133e09332fb5d6030dc939fc94850

  • SHA1

    c315498a86cf68b2d104001a9ff5620205c6285a

  • SHA256

    7657830ab5db762cbec824c09e95580b48945f7ad120502d8211d00866d4ec19

  • SHA512

    247e7a1b9f4ec71de3d640dff1890a3f3384b4ff1c2afd82d619108ff1e2a56388258d58d403632cd29df0ef151703669b2036a1237606846c43b6badcfd2d99

  • SSDEEP

    12288:pQm7YE7l2UE3j1Xp4xHAQHLRm0xWhR/tvzFpWBa3JrDoCDiWnw:prYHlp4xHAQ7xWhRlLF04BDTJw

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2