Extracted

• • Target

    9841a7fce9f90cb0bbdbefbb7033bc25

  • Size

    840KB

  • MD5

    9841a7fce9f90cb0bbdbefbb7033bc25

  • SHA1

    91386adecf08037670b94a41eceebfe2d2134ee9

  • SHA256

    9d7d86f4acd808e65a749bc0ddc76246a8ae66ff2cc380430bb36dc3a6efdf9b

  • SHA512

    61a3080585cae93ae592d1ab082bb7ed2350de3ac4a726f854b42d0243ccf9c1498592a57d9495fd4c62519a72e8f73d56b258f87f1ada800ebcb59d8401db8b

  • SSDEEP

    24576:NQMJx4YqqEAMjDbYp2rJTr8muA/vmt3I84ZASPzB:NQjbqdsDbJrJTr8u/vmnoASt

  Score

  10^/10

  upxsalitybackdoorevasiontrojan

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2