Extracted

• • Target

    b01c1b5d784c8799b2e448d542deaf20a5fca9e49a4f1d98fe21c76c440304cf

  • Size

    2.4MB

  • MD5

    683b33d2e0c23f6c37f5594cbf193ffc

  • SHA1

    df3826178b9062667330fcd6cc701cff6be67da6

  • SHA256

    b01c1b5d784c8799b2e448d542deaf20a5fca9e49a4f1d98fe21c76c440304cf

  • SHA512

    958c3ad6a2a4de54abbcef869bbe1f1f8fc30f68579d4bdac47a45893b2895fb0fc5e3d3819fa44069b8835b9e0e2b4ab28b39137317be90c449fd619f202488

  • SSDEEP

    49152:IEuIZSVI930l3GJ4eWkXM6fZ8Z93Pk1iEe0mo08Jypiz:IzIgqZ0l3GJ4HkcqZ8Z9Mwt0miypiz

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2