Extracted

• • Target

    a1a0526f930e53f722593134c6f1e144ab93a923bc2c18e5e25280f6f315c707

  • Size

    97KB

  • MD5

    86f8a95269fb6de45b0e400dfda36308

  • SHA1

    f4e6fa3cbe3c7e9baf19be290f193fcd8a494749

  • SHA256

    a1a0526f930e53f722593134c6f1e144ab93a923bc2c18e5e25280f6f315c707

  • SHA512

    79830467b259e5f10e1f19ad6b7afc74eaff7423c6791614ef9d6c040f0ecb2385eb65e125694e7dcdf19a9c109420916c690fc08f65403fcfd63bb25e751f13

  • SSDEEP

    1536:tgV8imDnow+YTDBzHem4jegPD6I7lHAn7Lv7qt6JqjqtI5GUttM:iVJUf+0+m4jegPOIJA7O6fe5GU

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2