Extracted

• • Target

    2025-02-06_0c742a38601997d1b0a754cd4f8ef057_bkransomware

  • Size

    2.1MB

  • MD5

    0c742a38601997d1b0a754cd4f8ef057

  • SHA1

    9a090ef87bac51eccc6e808d3d5adc62e09284fd

  • SHA256

    54426b5f566e7ff36678cd6bbd88b8a860461710ebe9b60d6ea02851654256f6

  • SHA512

    c1cbb759e5f451d13db687d42e9e9b0453b02d43b5a50263695381f3369197c7e7631de1aaa52a287470b851fb05e6bee40e6a731d69f42000b05b5d41bbb1c2

  • SSDEEP

    49152:5S5skDzci5R/DP7nmGarmFDM87CL9++86TIOSTXXG:Qvz55R/DzmGarmpvC5++86TIOSLG

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Drops file in Drivers directory

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2