Extracted

• • Target

    276a41b1ee88b6697c0be4da75deb54963baf4c86756d91eaaeb38e5f3d1fb8d

  • Size

    100KB

  • MD5

    6b0fc8578075981cdf2b5bece8eba0f7

  • SHA1

    ede8680d7f903a118c0ce7ff0ad6f0dce5283010

  • SHA256

    276a41b1ee88b6697c0be4da75deb54963baf4c86756d91eaaeb38e5f3d1fb8d

  • SHA512

    59f415f2ba6e5daac4c1354296ce766918126139c8f404611f455dc9cc209b57f5d0e8e575da20c020d388b20c3a00f09b1617d2604217fd469ce63730bd4cd4

  • SSDEEP

    3072:ZNStu/A4qdMWyFJkCQeUzB68JVsIO0wDb8i1LM:ytwAldmF9b8LNyQm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2