Extracted

• • Target

    91cb31c31b8d4d847df40776184d099353c3bab6b71b7ab16a515b1f729e4a47

  • Size

    100KB

  • MD5

    0c6dd013e8bd875443b80e5092e31a00

  • SHA1

    0b669a30856482d6095a10e5f4fd4a386789dcfe

  • SHA256

    91cb31c31b8d4d847df40776184d099353c3bab6b71b7ab16a515b1f729e4a47

  • SHA512

    738310790c72bf498d22b64dde8c04d28cc1c25f3f0002a3a483f3bc503bbf3b2bc900dacdd16cb226540e2792dc44d27ff379b48d848833f5b750ac61b492d1

  • SSDEEP

    1536:72mfJWv78NWxIzz/2p6CNprmhQTiQ9L0dSU8H2/H4MWX4zWZsh:72mf2o4xiz2/Npyh5Q9hz2P+IK

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2