Extracted

• • Target

    41717f55eb67809aa2421dccdc7e17f6ee5ed7a425cb6f251ac1734dd41849dc

  • Size

    97KB

  • MD5

    1ec273c114800c728092c731299967db

  • SHA1

    1b57989050fdc60035a9220f262498898dfe86f6

  • SHA256

    41717f55eb67809aa2421dccdc7e17f6ee5ed7a425cb6f251ac1734dd41849dc

  • SHA512

    3d1254e528e1d03ef0bcae237a6d485d62db02b75acb119fbe7f299a1b1f4bbeab8ca3c4f8b13c4b02c12e1b540b0552ba13c9e7321be62994d2d1a808960772

  • SSDEEP

    1536:Qb6MmyGHKB9cdereZt4YBW3ve78QCwqVlNBMdatL5z2:HMmyGHKYxtVBW2xCwqlgdaXy

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2