Extracted

• • Target

    9fbaa4eaff108044eb52bac5821a372ac40f770da944804774756ce07ec9aeb6.exe

  • Size

    65KB

  • MD5

    996f156680db69bed4123b2f2eaac84e

  • SHA1

    cc06811e41bcba787f75cca786a972367c679937

  • SHA256

    9fbaa4eaff108044eb52bac5821a372ac40f770da944804774756ce07ec9aeb6

  • SHA512

    e0ce8eeff4d394e2f0a3e37c2e0bf3574cdc6a006fb7b21eb34083add78cfca93f7bb9a9109d9b24f31caa206923dba2c7008ac23dc72f4f9dfb3e4451fe7c42

  • SSDEEP

    1536:K7/REluipBDhmeCK4e8vo062cLHf8BVyKauBAAyWDMzv4gi:qEsiTlmeCYRLuVyK/BcIMZi

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2