Extracted

• • Target

    8d8c5ba8f2f1732c97118c99758d842229ee1a2089f44ce1201b85401692422e

  • Size

    4.4MB

  • MD5

    90b8db7df467a8eeb011ad3a74743a7a

  • SHA1

    fa97b9f640dc848581352ef6f09ed65cfbf446c4

  • SHA256

    8d8c5ba8f2f1732c97118c99758d842229ee1a2089f44ce1201b85401692422e

  • SHA512

    c69ada7d5073b5eb55d8ad1dbb6a051a1939b32fb4ba02aded7e91270d8c7e8b0c4118840c374278f307e8c36cd7da308a3bdadeb79e3536eed09eae9b4bb552

  • SSDEEP

    98304:uvBVk0Vwv2EHBcTHn5DBnV+nWoKlgIkUhWc/sHVskvpIt79f7bTYmZj:uvBVkb3hAH51nVgMlwoZ/l7FPTHj

  Score

  10^/10

  upxsalitybackdoordiscoveryevasiontrojan

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2