Extracted

• • Target

    补丁校验包制作工具.exe

  • Size

    140KB

  • MD5

    ab77792d3b90f5f2c298d4e42a9a09ec

  • SHA1

    3e51a53026c60e4d32acab488a8f25df558297e7

  • SHA256

    0b87fb9be9cc8adedbd6d747cf7fe25ff324659cb006f05d9716218d98c7adc9

  • SHA512

    f53c74bac8d67a8b7eeb1364ed3707e2588af619592e4b2eaca65e7e9bdb15e4ce3687654e114a88bc448fadeff5ccbc6cc53076a0c6806104835eca3b5975b4

  • SSDEEP

    3072:XPu20auEel8JNfp0IVoBArO8LRfLYSvVhrTJOU:XO/cKAdfL7vVhnR

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2