Extracted

• • Target

    ec041e77397f34cdace5e72d202789dbdad2b21fc9e034a18a0f150f80aa4d92

  • Size

    978KB

  • MD5

    3e1aeb84f4855efa8feee735b0fdffb8

  • SHA1

    4c9ed21f85333781d6b3279d52453365b864364d

  • SHA256

    ec041e77397f34cdace5e72d202789dbdad2b21fc9e034a18a0f150f80aa4d92

  • SHA512

    6975a223233cc424221dfe52e1ed9c17d236457174f9aac12764d51f3dd9a646af3905fea5950c8bbc40333dcf011299d01bef083cf50dfcec6440d3df7e9e79

  • SSDEEP

    12288:m+u8TgCgW7Oi2+Ae4FF9zR3B55ItPOgzhWpNu2QwVLjdDjN6Ph6LMkbUttQRtCtd:m+uG0W7d2+d4P3BEzhWpPxL5D0zscOC

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2