Extracted

• • Target

    37288370a633c721f837ba9d982186e3030a0cf456bf475718041648286c1183

  • Size

    536KB

  • MD5

    0e30e96b1b9d3f438534ce86c47a1390

  • SHA1

    211b10615e6a591b454bd41f5af617786e1ab1ea

  • SHA256

    37288370a633c721f837ba9d982186e3030a0cf456bf475718041648286c1183

  • SHA512

    4feb26ef8a259c143c512107ff559cff8e71d70af66884c60c37e9cde25f4386b13f9977e8e5eb2995b5d51594b6bd64157ce1f4ba1ef0a70692076c2d9b98cf

  • SSDEEP

    6144:3BtpvoCpcNQ1jQdivpWFY4tpvoCpcNQ1jQdiv:xtpvoJQuFdtpvoJQ

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies system executable filetype association

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets file execution options in registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2