Extracted

• • Target

    d55262e2fdec8014c394d5e6686ad94b029243c96390d40f9404c7f2c82f0f9e

  • Size

    3.4MB

  • MD5

    2e279d8065a6439d0888f95d4bce7823

  • SHA1

    2a9cca07338df19a2ddc03b60a646aa09feb22aa

  • SHA256

    d55262e2fdec8014c394d5e6686ad94b029243c96390d40f9404c7f2c82f0f9e

  • SHA512

    ffe840b279c1b14dda668c5e96677f4c3f626b7c65ec0372d3f7645d039e0509f41df9c731ef6d3553e1a843a8372b2dabff2722a4ff29cb33e87fe8b1507a64

  • SSDEEP

    98304:1Tu5HMvw5LCe9YqjQ2kvV3zwjCeB0RbAZwNt2On:YMvxeq4Q2kvV38jCt8mLb

  Score

  10^/10

  upxsalitybackdoorevasiontrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2