Extracted

• • Target

    9a2015f300c0697d6eedfea61926e713756402f3671577b02ff363969066c1cd

  • Size

    97KB

  • MD5

    46d070eca441ba514ddea118b89477cd

  • SHA1

    390f713bb5983e3bb5903423fd07faeeee9b0556

  • SHA256

    9a2015f300c0697d6eedfea61926e713756402f3671577b02ff363969066c1cd

  • SHA512

    50981d03f22a2b8fbd90fca26b1fd62f0c23f47066fd9c6c2daca10dfd627a56bfcd53389762efab2ad61e8b90a223fac3a2e3a082ff4f508903e00d12792763

  • SSDEEP

    1536:Lr/T08jgT/JzgzuUuK8IhWbsPIeK8GCuQhoVeKtWXOSXildwmE:Lr/julUuUhaHCuQ7D+SybE

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2