Extracted

• • Target

    3f330de4de9dde9297ca4e8513d6c6b1

  • Size

    100KB

  • MD5

    3f330de4de9dde9297ca4e8513d6c6b1

  • SHA1

    3f32d133a9ba2fcc815eb6c5de34658bd7e9f09d

  • SHA256

    34b3ef765ce156ab94a562e025df783cdd2a6f3d5d4022cd2839713b45c3a229

  • SHA512

    460ba9b0f4b39a78e52be65b382770ac1ae3605bd2308b3cbb5c385a0dda0800b95969b2659473c6409b6285d01caee800dae423a91869f8f1c6478f6ec703e7

  • SSDEEP

    3072:U49ZW2hKwYeQJousk2zMSvOeLUEVfWPV7:PZeeKouskSMSDLXm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2