Extracted

• • Target

    a5f3fd27dabf45d11c4bc250ed2e2ae475213c9de6e1cbab0160652fa251c03d

  • Size

    204KB

  • MD5

    5cdce45d479ff69098f8ea62aeb62e86

  • SHA1

    8fe411818a5995d42f9ae0b530aefd365be1085e

  • SHA256

    a5f3fd27dabf45d11c4bc250ed2e2ae475213c9de6e1cbab0160652fa251c03d

  • SHA512

    62b2b21ec3e19c9d7ec5ec8c548136405ed0152d9a09ec69c921316255d5cd446bc15a08cad2f42f0a6bb26291c98288d11c5a4e659d00cc95744870aa89c985

  • SSDEEP

    3072:z/YjXzRL3y4CpCfCGCCOCwC9CvCFCfCLCvCUCLC2FInROUSRSGSuSQSmSNS4SQSp:EjjRL3yGFInRO3QnccDpS

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2