Extracted

• • Target

    7df88cf4afafd291cf3978ecc676389eb95fe95683c0da8708cd7e6d437390c7

  • Size

    100KB

  • MD5

    d218f6601f773a40fd9441cc710e1bd8

  • SHA1

    936074dcb4beabb6954d6db110f7daef85c1516c

  • SHA256

    7df88cf4afafd291cf3978ecc676389eb95fe95683c0da8708cd7e6d437390c7

  • SHA512

    604bdb504cf1f81112e74c3c6e0cf3256b368d4768ac1174ac5c158f03ea782f174749542fd0b85eaaa5c4b6430aa3298acc505d9f41c92c81ac62f61e0abaea

  • SSDEEP

    1536:1VQvf686nGm5nCzvI/O4/bMX8j5dJNSgZ2xj8NVasQf:Yf68QGm5CzI/r7Nr9NVDQf

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2