Extracted

• • Target

    8764bd3beaebd1d4328dccf9a1d56fec78e1504b9f3597d5afb8730c3d64771e

  • Size

    128KB

  • MD5

    489eaec426d65592a04f4281a697d764

  • SHA1

    c0c785919f3695269ccb4950ab8934376e165d0a

  • SHA256

    8764bd3beaebd1d4328dccf9a1d56fec78e1504b9f3597d5afb8730c3d64771e

  • SHA512

    f46685328f343d9bf41d611a338ccda091d2049179dbdb8004328291b910ea8d52b1cdbccd631dff7c35f3ec3be6de8bbabde0ba293b4c4a4ecd3aa12f19c8db

  • SSDEEP

    3072:EJCD548iJ+VO5rfaAjxy2TpMKkCROcCwIvneE/9e:njefXdy2GKkEO5d19e

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies WinLogon for persistence

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2