Extracted

• • Target

    2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210

  • Size

    888KB

  • MD5

    089595a683bbd93298336f88a9adcbb7

  • SHA1

    13aa6e9830caec6542102c33eb5d228e006a51bc

  • SHA256

    2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210

  • SHA512

    e0ad0f44b62b4abc7b3830a0309097cfb6319f350bc427ff444501854603b895e155fa30515bd146382d8f3246cd1a44afd803129b666ddf7e6140b7b4c6862d

  • SSDEEP

    12288:BwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4khozEY888888888888W88888888:FNzCtUpQ9WWPBSSRMTEpFNXFG3ny

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Drops startup file

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2