Extracted

• • Target

    9704ace650959e53a01dbe9178d5d87652559f975e60b0a8fc03cb2f0b646f0d

  • Size

    100KB

  • MD5

    2c59de12423b1e65a4bd00315c290fb2

  • SHA1

    6df1ccebeb7938a21dde3acc565a890decf28d16

  • SHA256

    9704ace650959e53a01dbe9178d5d87652559f975e60b0a8fc03cb2f0b646f0d

  • SHA512

    fae51f47c9bd097ad29f4562130018dcff1ae57aa02efe0a78a4547bb75b537da26db616dffe84c4e6905b9e76ff8fee09da7ea4f3ba0fcc3abed10318f8073d

  • SSDEEP

    3072:kpqN+oOFFw8wbteMm2RTe8VRVOn2UWkndij:xNFKw8wcMm2e8Q2Ada

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2