Extracted

• • Target

    e978a1b81760bea028e7060afe2023d85332c0353557652532b79b29c613ad55

  • Size

    217KB

  • MD5

    d290eaa41f199e78b72d6e3e9c08b019

  • SHA1

    1aa3e73ee3d183ad30eef11dfe9ffdbe850d9923

  • SHA256

    e978a1b81760bea028e7060afe2023d85332c0353557652532b79b29c613ad55

  • SHA512

    7798deae3b0581b3fb338b568d96620c92a64979a614318d4a814cf762392e0faf9b66ef13a1b938698ac9bedcdfb8401ff819d2e98ba1ea3550553f0b34f5d3

  • SSDEEP

    3072:1OFIJ3oVdY/UiK7+YoPgWVJooHAUjg/S/co3M7ZSTRowOuK:1cIhoTH+MWDoLYk8isovuK

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2