Extracted

• • Target

    2d393827a0458f45627fdc114dc730e3

  • Size

    100KB

  • MD5

    2d393827a0458f45627fdc114dc730e3

  • SHA1

    7021646de08a6c59635a6c0f6bb31f7a9e83a65d

  • SHA256

    42db8f380b188e785a1126f6fa37febf0f7ce8c771156b0f95817fe7b67b4867

  • SHA512

    ea0ed5f0ad878d2adf7184052eb50c9ea4099223d91f17de4e548be7fb82ef2063ad6eadde1460bb123f3b8362579c2ed67953c3b823ba234ec41009116036f6

  • SSDEEP

    1536:S2Qg8k98r2qR3C9Zve83u2RrJ9n25bsvYnam98jy/x0XbeLCEfgn7MeCjF8:7H8DC9Zr+u2tsvYnT8RXbhEI7MeCjF

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2