Extracted

• • Target

    SecurityHealths.exe

  • Size

    664KB

  • MD5

    1b04b8062dd9cceabfa5c6f2ec6302b2

  • SHA1

    9ff95a3dd1bba1dcf63809b00aa320a1104729c0

  • SHA256

    f8663e37a4df974fd50038af0b16f9b994ee9eadbab852369a9b816918d41f97

  • SHA512

    990935879bc56696d002976e9af6451844b5898be72368fdc27ac9f0cdbb060f8d9838ab3e03431e6501a62c7ba81f2ec37f2fbf82f12104199ce58c69aea1ee

  • SSDEEP

    12288:2DKDBnRhiEFs7aonCVPdk88KzIxH3tsxV:2DKDBRhe9CVPdkAzIxdiV

  Score

  10^/10

  chinese_generic_botnetsalitybackdoorbotnetevasionpersistencetrojanupx

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Chinese Botnet payload

    botnet

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2