Extracted

• • Target

    a667b7b17b074fdfc44175e54cc1feaaef351b4eaa9322da2687ca7460d9a5fd

  • Size

    300KB

  • MD5

    cc0e67db7cbe361698cd6d9c26cb6247

  • SHA1

    e5da85f9a5b32e77ca0de3f74683a9d1a5da66bb

  • SHA256

    a667b7b17b074fdfc44175e54cc1feaaef351b4eaa9322da2687ca7460d9a5fd

  • SHA512

    2d23364e7743b6038fc4a8642b21569c6ef0a0259e206c717300d55579d0fe8a64fc05415ac14dc7af37c4e771e7378a89750a29570b5f72222adc6782dbfa34

  • SSDEEP

    6144:Eef4Q2c0/lXcqg8SJoZRuDH1hh252Gt9pi92nBVOzE:v0/lX9g3oHKc5btHioSQ

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2