Extracted

• • Target

    bfeee0ebf162099649cece2a38f7d1969dad64b86856d8464f7112f0741ced67

  • Size

    77KB

  • MD5

    dde677a5d95093a096bd2d4cda3c1a23

  • SHA1

    b5f8691eebf36b373d327a28416be279c63c0e32

  • SHA256

    bfeee0ebf162099649cece2a38f7d1969dad64b86856d8464f7112f0741ced67

  • SHA512

    b50fce7a7b22697217e9c41df33d52b416c293eff677da2f7ded1b0ddda1ba9f43f8194759f8f2ddf5b26a2c4fdc8f14f207d808eedab3e9b8afc46de68763f0

  • SSDEEP

    1536:nMf4gbRN1a1Ixxfln5Qt4khDdFVwmNpfvMMC/i7oS2Hp/f0T1g7Ef/+Dc:MgA1bLffQWMDdFfB7o9W1eEfmw

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2