Extracted

• • Target

    faf925892ba8e7232717d40d165f5b220ed91e1ae6ac4cd1ab52d8a756dc7f70

  • Size

    100KB

  • MD5

    9c18e87a11b91d561ca63c3504716c8c

  • SHA1

    7f2327dde67f01304e1a11537df19c2dea87d1c2

  • SHA256

    faf925892ba8e7232717d40d165f5b220ed91e1ae6ac4cd1ab52d8a756dc7f70

  • SHA512

    3c5ef9066c080e1edff7e3a574bac92776dccad5bdb7141aa2cfe514eb59c39115760f8a58a19a6479c37ca9c5d93525d6022c75eaaba3bc1b1cfb68db4eb1ba

  • SSDEEP

    3072:jOSPt/kvhpPRuY482AArNMAM2zAvdKuyA1z:jOMgpPR74DAoZM2zipz

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2