Extracted

• • Target

    c7e7463e0549183df3c60633360ba1969b70b02558aa6d5f6b427d44bda2fb6a

  • Size

    3.3MB

  • MD5

    bd150b450f2e495ac8eedfc003a0688a

  • SHA1

    e598bb51b2df62cf42fe3d3d4cde9457fe568026

  • SHA256

    c7e7463e0549183df3c60633360ba1969b70b02558aa6d5f6b427d44bda2fb6a

  • SHA512

    2dd823db08d41f895ce99f1a94ce338261b5403af86c6925a1840bf99293c74b176792262d7e2b408537328e9b7b5001df676806dcf50931be077c3009e65754

  • SSDEEP

    49152:s44nCGh/w6CJ5VggggMgWZ5/WICQ5M5mrmz3MgIuqbLKP/hkSCcNxVzNJQIKWDT4:wc6CJ5GZtW9mrmX8gh7CcNxVz7o

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2