Extracted

• • Target

    e651613dae47442f22c83e35c1ff73d9c84762c9e1b995f598c243ca632ac55e

  • Size

    211KB

  • MD5

    5afd092116be71db537b71b7a5d8f7e0

  • SHA1

    6c05f318377302278cda2639559bcc3ce3c91db6

  • SHA256

    e651613dae47442f22c83e35c1ff73d9c84762c9e1b995f598c243ca632ac55e

  • SHA512

    a9062f733e3cc2603ef09f2354231402ff6d248d0b25591001747417e3693a6ed70af70d257686798fab56131dca1b47f5f27ea597cffcb69eb3718acabc3ba2

  • SSDEEP

    3072:dm3K+WkUPb1WpXVxAaGBvbNvNbNJkvmhyPQbaDTUXGIDbwKDqCtrwdAxaVTtVHLa:cxWjoIDbByGPMsMP74Akb6tSBk0

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2