Extracted

• • Target

    5d6b895e208226d99be411502f243df8a6cd56d536d17bbd7f4e8a89cb407d4a

  • Size

    416KB

  • MD5

    2bbb76dfa85550ef8f69f58006efb410

  • SHA1

    6811ec43e5216065ef28f4c88ad7717057cc1b07

  • SHA256

    5d6b895e208226d99be411502f243df8a6cd56d536d17bbd7f4e8a89cb407d4a

  • SHA512

    20b9e00fa199192370772cc98bee0eb9e152f1650d8e15f91fdd5e79b24d516e2f9428de3d6bb7939cd857a9dd20896c03b58fd6750989dfa167d3e61edb5d5e

  • SSDEEP

    12288:elQ8fXEBvuwjInnLEzRi1Al/P9QpNZ4PuYu7:ehEBWwMLgiU/PSrZ4PuT7

  Score

  10^/10

  upxsalitybackdoorevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1behavioral2