Extracted

• • Target

    e3f1e99af518730f2c358aecc6d21130ab5dfedc3a4230beea3bceeca179e7e0

  • Size

    132KB

  • MD5

    13d26fecfd913a3201bde8549a5ff2f0

  • SHA1

    d7c4726cd6df40339d0f939c191f4a7871aedf32

  • SHA256

    e3f1e99af518730f2c358aecc6d21130ab5dfedc3a4230beea3bceeca179e7e0

  • SHA512

    e86357317184bd39c5ac67f81e644bd81fbe215bbdfab4f17baa03e3e66f6dda345d41750ac29d4c34dc971d146bc04be7bd2fbd9d6d52978983c61afe47b557

  • SSDEEP

    1536:KJf83W8W60IL26Ap8iJ7+gncqN9SqboHNBCXRbnm6xveuVxX/2saMNRkoXvKU3dv:KJCD548iJ7+gdN56CBTrDKOXvBOcFvFn

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies WinLogon for persistence

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2