Extracted

• • Target

    78ce4466378ef409401f32038ebabf9c2d5c8bbf

  • Size

    100KB

  • MD5

    d8b1e19f673cff7abe7083d12f0d5e5d

  • SHA1

    78ce4466378ef409401f32038ebabf9c2d5c8bbf

  • SHA256

    ec3ec9fa9c881a6bf8566680b15f25be33dda93b36ea1b1d44a89b8cd2561f8a

  • SHA512

    9d7a4095a35d064a145c7742df4776205347937bae243f135a140be8d6e381858c6fe07df55ad34a92c76cf3ac1c88ba8e2813949fd0361040d2a36256b8ba8b

  • SSDEEP

    1536:55PUE1OqVkh8Y1BabOX7OMkEfWvBUOLKiMvHfVLKCUXZDs6PbDY9ud:5h8848bOX7KBv+OLYfVKlZDsgZ

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2