Extracted

• • Target

    7a53afa8803e5d8cb169fd067437fe51

  • Size

    507KB

  • MD5

    7a53afa8803e5d8cb169fd067437fe51

  • SHA1

    a81acc31b598e1a640ef91b1c4abcbf827f17a0f

  • SHA256

    1fd09d82c72e2f59384bb25dd6a47a6d45e38d2d6aad5a3df19d8dc2f4dd69dd

  • SHA512

    f8df2250af6be54e38f8bf127d66791dd1eee94c09996443162a66644de31f1f270d17bd7314f193a109db2c838545f579839ba1e758463bc3a532728b05bbb7

  • SSDEEP

    12288:SLgI37qsC/rHyq6ADx09nJenVjP1/y9TTl5D7RIF5TQwRh6lC3fj:Sb37qsC/jyq6c3mTl5DmgwAIfj

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2