Extracted

• • Target

    efa852a9537506dbe6d5eca79063f625.exe

  • Size

    97KB

  • MD5

    efa852a9537506dbe6d5eca79063f625

  • SHA1

    50ffe8148a325b0b8c71cfaff54d94c542323367

  • SHA256

    b8d660d613425a565c48aeff5cf30d670df06920d6248a2fbd251cd75b55a478

  • SHA512

    23255781a3da98b4c48fd14812f0f4e71cd792a8476fe069ed6d3763364b4c41bbf31909204958889b67bd99d0e24d33b1289bf4e25d3631ccad1e3a72250c79

  • SSDEEP

    3072:5IODf2zEzog2KR1I9+0CKpLggWiVdIDejU7IV:5Tz3Dt0t0iVd8eUm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2