Extracted

• • Target

    79927b7246eb40b372a8a83bb8a57d823433905900ea88954a833249a347e861

  • Size

    100KB

  • MD5

    1bce2d8534c9ead165a840cc40fdf4c1

  • SHA1

    81edd1351bed6a37e57aeb4f8e100149df0e11fc

  • SHA256

    79927b7246eb40b372a8a83bb8a57d823433905900ea88954a833249a347e861

  • SHA512

    f877c2a5dfffb743624ab95428148f8c2499b34c9ae15a593126d21ffa5078c3d6b742448c6bb57ce590e76a99a794752c6253ea710903483702412e94f26144

  • SSDEEP

    1536:meCQJXNhAriavTPHT41YGuxxzyOYcRZfFKfMFSN9njUmq2MKL/:m/QThcLTHT6qyOYcPdKL9njg2lb

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2