Extracted

• • Target

    c2de5ed0a9303e380bc1872578ce4a3195c4ff6b0277509206ad922e800d2367

  • Size

    97KB

  • MD5

    4329b85f9f67c9f3bbd11e79e5aca1ab

  • SHA1

    401687e1c8817056881100bce8fb863830f0f0ec

  • SHA256

    c2de5ed0a9303e380bc1872578ce4a3195c4ff6b0277509206ad922e800d2367

  • SHA512

    996aefa150f8251824ab60aa858e36682926c35c8255dcf52a7e3f9ab9839daba41b943d94766d93107106d3c0c31afe12e47a03b6cf1c21bf50934c774abda4

  • SSDEEP

    1536:hveJ7Z4SyeJ3YryisS7pcWRAj4kySX1a5tgbrkf3+MClFLCdCr4NG/rBXBxc:8n49jryisipcWRAj4kRX1Gw4QeNGv

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2