Extracted

• • Target

    36de0e64bf4085a6719b2dd4a5dfa64a

  • Size

    100KB

  • MD5

    36de0e64bf4085a6719b2dd4a5dfa64a

  • SHA1

    988d39271a87c08e08303e02f168dae65a757cb2

  • SHA256

    47dda038a91ffbb268223a6790d61bc61cc501fb8b20d1f2e28a630e9925b50a

  • SHA512

    3a12ced6708766f150ffbae9e563de047a91b2a0aa1f5d6e081070a2830d7f0b90dd59eeef0825d60363198190c4d709e0ad5d73b5aca643fbdd664c9bb744f1

  • SSDEEP

    1536:bNX6qhH38y57rKupmnGPru9rPttVVVdertlCmc:bNVB38iKup2QrePtZVderSm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2