Extracted

• • Target

    ac03ad928b20efcf085969a571597379813247c52e3288313ef0ccf8563c6d7e

  • Size

    65KB

  • MD5

    21fa506459bd17e1bc6f5651c03f94f3

  • SHA1

    49e1eeaf6b1a1348db0e091500aa8337fcd518cb

  • SHA256

    ac03ad928b20efcf085969a571597379813247c52e3288313ef0ccf8563c6d7e

  • SHA512

    a5fb7b106657ea009392dd2db6418c3d895af5bceeb6469d345e4eb98370e7dae8a8dbc166de89fc8eeb4d3a7604961f3bccd798495b4ced7f2079896cad2cf6

  • SSDEEP

    1536:A8OEpI+wsnPfThBG3zQFhfKGDwSD6v0mv7pLBwfJam:A8LpI+BLhBtK6wi6vX7p1wfJam

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2