Extracted

• • Target

    15912d608affc46e721a7693c147208e

  • Size

    127KB

  • MD5

    15912d608affc46e721a7693c147208e

  • SHA1

    ef0d25cb782f031035d0766c2cbc12090a393840

  • SHA256

    66b7b6f56492ee7488721b7d903fae694b620da0b0419fdc0a33404a76223d3e

  • SHA512

    0d48abacde2285549aee40b945c7d7f1631b20dc8cac1afc9ca8d98abac9535518fc4537b8cacede8e7261f9d59c02e7a7b7237bca4ab39d97ed07c9773bc9fe

  • SSDEEP

    3072:h1PPwpYNu1e/z6V8rnG6MA9b5c03mm0FrTH6ul:h1PPwMLb6V8rTr9b5DmrW

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2