Extracted

• • Target
    436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321
  • Size 3.0MB
  • SHA256 436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321
  • MD5 5751dfe3132b6014b86b932277d828f4
  • SHA1 04f1891908dc3255cc321359ba68d34bd07b8d2c
  • SHA512 0406882eb0d4e311bbb9daabdf59f6f4f292a5285df22ad3a10ddf853a974d3bac40493e5e0b0015121be8f010a650a75510d6b8bcb0d235a174751db37c861e
  • SSDEEP 49152:D6lhxiv21qo5iNYhPLop1exIoszDVKbYTyxIapoVe:DKULo5ieho1bXDVGxJpo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2