Extracted

• • Target
    ce97e89e90a639a4439f65e3b74a9d4575f69e2e8ba6bafa90ad9fc140b691ba
  • Size 2.9MB
  • SHA256 ce97e89e90a639a4439f65e3b74a9d4575f69e2e8ba6bafa90ad9fc140b691ba
  • MD5 d6b524f167d66e47732a8d571d77ad8a
  • SHA1 3153337307f5afb83666f87a281e8554dd704504
  • SHA512 29d65092a7aaa7a02937802676f59a4e6ef78621a923b09b2b97a74961c3903a8f218b2441911bcdf54f49ab706743495192595522d950c74747d0ca2d20d0c9
  • SSDEEP 49152:PfKMhB+xFZaotJqrLFdbsf0HLBUl/D7XKqb4SIN4dEXhEqe6U7mBU5SbtIQrWeyH:nKiUrNtmLbbsf0HdUDLc2dAimBU5SOQY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2