Extracted

• • Target

    5693c9a9f64979f1f953066b69d6407ac45a5015748e35ab5911a96fe73ccf25

  • Size

    218KB

  • MD5

    7bb8525c3c8854cb45a81c0771358999

  • SHA1

    a51eaae062e4953ca8b4443fa5ea332ecfd4eb62

  • SHA256

    5693c9a9f64979f1f953066b69d6407ac45a5015748e35ab5911a96fe73ccf25

  • SHA512

    e4c932980ab322fa0fc4cc593209a85a6ef999f9c20d1f7eafb6a906e3f0b42a62f19d88c27b3c7858a4cd90f6e517523ef788a4b509356a00ce9dcd71367ba2

  • SSDEEP

    3072:7nz2z/jMwe8Mco9+qol6WpJ/HAU1n/4SpBG1HFkdj/LYbEWyWHAK2ew:+z/k+SWPIcn/4STIudrLAHAN

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2