Extracted

• • Target

    312f26c90b45e92809ad3dfb3e72f450413deb21ef8fb4cf8d2404b12a9d6cd7

  • Size

    448KB

  • MD5

    2075e021c9c74f74e94854d5792c3fc4

  • SHA1

    ef998c92ee0f768ed86cb7a1fba1c9847007e62b

  • SHA256

    312f26c90b45e92809ad3dfb3e72f450413deb21ef8fb4cf8d2404b12a9d6cd7

  • SHA512

    47ac95f6517cf4e32968cb1127446fd38fd34ad4851d0e610a8475b2186804da90de08fa4baff2879be743d2f0e166420b26d108afada3d84a5ddbaaf2755af4

  • SSDEEP

    3072:ynAdrtGJGxJ9ptWrvjDb9jY+3Eeh0zlR3C7E6LUKrwt192MeAgzh3xJ+apj6+GiP:tiGv9ptWFZEeShRyhrOjN2xJZpjrZP

  Score

  10^/10

  chinese_generic_botnetsalitybackdoorbotnetevasiontrojanupxpersistence

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Chinese Botnet payload

    botnet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2