Extracted

• • Target

    63991f91c8e6a0ea4bb20431fa6f11e5a80b52fc0e4a33a109bfb547c001f9e3

  • Size

    1.2MB

  • MD5

    7ff52acf2b53d2b5a53b4fca405b3e78

  • SHA1

    8c740dbb941aaa5af7addceca34e73cd41fc28d6

  • SHA256

    63991f91c8e6a0ea4bb20431fa6f11e5a80b52fc0e4a33a109bfb547c001f9e3

  • SHA512

    5f54ec667b1c0b578858aea83c793a03adec3323a49ddaf6465cfbd2cd8583ef16a94db82ec1c139603d41b66ed05c1fd817aabf7f5a91c2ce68459ceccaae87

  • SSDEEP

    24576:catIvCEBXufFWij4EBbjQjcKIzs2JhoYQwORdYJK4NXJVz:wXwHpcszs2LQ3RCI43Vz

  Score

  10^/10

  salitybackdoordiscoveryupxevasiontrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2