Extracted

• • Target

    994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a

  • Size

    207KB

  • MD5

    05a3ca3ba03923b9dd85a2d7820724b6

  • SHA1

    26be66fde5e7ab96d7413016658e6bbd293fdd5b

  • SHA256

    994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a

  • SHA512

    7d27d127d6b78299c80bbc8c34272320fa1c91aec6a0db86309b8d6889d4a49c2a478919b827a02ff027e5ec728d198596556014f24bdd13a10fbfa8f8e32eb4

  • SSDEEP

    6144:8JvqJqyroIDbByGPMsMPHeOFEWiiVHwblfwE:wqJqyrVyveOFXLxzE

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2