Extracted

• • Target

    036d1b30a27342570ded43f9c789d6f280eca738

  • Size

    100KB

  • MD5

    d94ad6411727f1806844755277901b99

  • SHA1

    036d1b30a27342570ded43f9c789d6f280eca738

  • SHA256

    822f1ea403e7d4aedc1e6bf6cbcc7adb60637aed2f17e3a5f9a659b9cb302ed1

  • SHA512

    41a235ca4bbd6a2c634b82c1490b68601e649afa49750ec2f1c37c9db07c3360a1ab0bc950882b22ccf86720050690cb3c7b49f32bf3e7c214ca5279941320e7

  • SSDEEP

    3072:fKtAtAw7CF6TpJ9+HVUzdg/Fpc5giKVgjXhbWq3icnvd:Oi7UcKS4Fq5giKERbWE

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2