Extracted

• • Target

    8ae5079687de2fa00bb04ea846fc5447

  • Size

    100KB

  • MD5

    8ae5079687de2fa00bb04ea846fc5447

  • SHA1

    0cf71ff93734f68cc1f7c847673bdce76f6bf247

  • SHA256

    23be5bd50752f46c0e641420fbae5320af6ac4cddd25662e5894f7098b3f218f

  • SHA512

    aa2dc34a9eea10f1d5314e3999e790c92c05e801dcb19c19126fcaa324049eedf757265e62c0c859f9ac5ab5ff0b36330e189ffd8675f746c641decd26fc19ce

  • SSDEEP

    1536:J8ltOM9c9PXLwiykgPO4B1aC8aygqvH9JPt4Wu8nAQFlGYDvGhQX6:J8ltu1LByVG4DahBfVJPtfuUNOM6

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2