Extracted

• • Target

    ed67069206aea8164ef88f450b0d1241f4b2d85021654a35ffcbdcc13a103402

  • Size

    315KB

  • MD5

    13c40073a879095fbc2327a908301636

  • SHA1

    b4c78c9792520b7396afd8f678ce50ccdb651220

  • SHA256

    ed67069206aea8164ef88f450b0d1241f4b2d85021654a35ffcbdcc13a103402

  • SHA512

    e94ca7f2aacd0c67907f42586ef43d0296ae7227480fd4c138b8801e6ee11b2f2ebe48d4a5ded30f7b7af428a61de884d23ecdfd16b79ef4cc5a4ddc6ab69e3a

  • SSDEEP

    6144:dxlZaFDLrItkluXRuBvusFjJemp8dqoOiEzfZigLyMXbSlgHKpMwEUVHt:XlQ8fXEBvuwjInnLEzRiAyMXbKAuVN

  Score

  10^/10

  upxsalitybackdoorevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1behavioral2