Extracted

• • Target

    3b741529eb8d04c3faaf76fc16162664301b2a70b45a27c8bdd0ed15ebc3d87d

  • Size

    100KB

  • MD5

    3137dbfdb23efc12a6daf811c75bd07c

  • SHA1

    a4b64f1da64c9ea3c98a30e5cf024ce3ef585394

  • SHA256

    3b741529eb8d04c3faaf76fc16162664301b2a70b45a27c8bdd0ed15ebc3d87d

  • SHA512

    ce5dad2e3f0d852f7ccebf1c92ce5956aa9af2447e36a77357f43c57a1a02aaee2870f4a26f12f7d7b5a47b79499818848af46bbbd00c9ba5be869709442c511

  • SSDEEP

    1536:MFwpfJz8Lzp3rXOHG5bhq+rN29ylwfCNegyH+9V3QPBh88:MFwldEbkGRrUIwfDFiV3QPvf

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2