Extracted

• • Target

    97277298232d44ead0bbfca3074d4736e3e8b551eb253eb311ed4acff956b7c4

  • Size

    96KB

  • MD5

    aafb3a0031c586a113bfdb3987413014

  • SHA1

    b2a30a84c3d142f41a5d305d4a31b0d634afb425

  • SHA256

    97277298232d44ead0bbfca3074d4736e3e8b551eb253eb311ed4acff956b7c4

  • SHA512

    6535864d0d10799e707e1f2b5b206ccef36d765a8666b61015adcbac8ddd74df40995e16e624a11625062e1e5f08c199bdd988b1cdfe5559fe829dafda0169c8

  • SSDEEP

    1536:bwqu0hx3ckr48GYbFvWXzME4SHt63icymO4u4bJAJESkPU0:0Kx6Ybizp4SH3+O4NtAJE3D

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2