Extracted

• • Target

    31d8bb99f31741e0d706c7171348a68da6d5fd8f5f4dcd007d1d3329a107d895

  • Size

    2.6MB

  • MD5

    9f8ef9f26806547501d40079488877d4

  • SHA1

    d75542433696c544a2266c5dc17a937baf5d468c

  • SHA256

    31d8bb99f31741e0d706c7171348a68da6d5fd8f5f4dcd007d1d3329a107d895

  • SHA512

    079b3c1c7984ac40f0e1116a19f1a719459d28779d2464f1aa450dfe6e35fc2745a5f28a6ba3cd91eb5394d2624f6d41e1301d1177032d21bead16c0a75189a7

  • SSDEEP

    49152:4qeN9mJIwe9X/E4dIzSY3G//Iisfy5lKXpGgMTr1:lI9CIwe9XMcIz72/Qisf6lYMTr1

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2