Extracted

• • Target

    1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

  • Size

    672KB

  • MD5

    4562f9542486b1aa6bf992123ded1f91

  • SHA1

    e9744f0a0262c79094e4c4395d0465a30cccd2d9

  • SHA256

    1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

  • SHA512

    f43cece6b18792dfa2c6e8a04c68ceab1c9ce1a9ac6f30501166d1a51b2c63044ccad2e15e9c9d3c7f154eb9c6a368f5073373ddfdd25080a450b5ed06f5cd6c

  • SSDEEP

    12288:zNdwLIYTAGmmvNOFvXhJfnUhhrBoZ5p+cKdxFu2BYGqA8kKZtXhLVWdI:ZdwhAGmgevX+hrBu/GO2BYG38kKxpK

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2