Extracted

• • Target

    9ac782c1c0a23ad6a1092bdaaa78c17561335625446f438d7d934b49aa523930

  • Size

    132KB

  • MD5

    8bd5d568d369a2879c839bdab44f29b9

  • SHA1

    214e2e43c691751bc058e2b2db8eb02066c86505

  • SHA256

    9ac782c1c0a23ad6a1092bdaaa78c17561335625446f438d7d934b49aa523930

  • SHA512

    e486f6758391034ec3461efd6d3b1e35425dfa4facd0a5633cbc706899afc7926754d127b86135c3bf2887e1b45c8fbc6e90344958609ad9eb64d35c02fc5daa

  • SSDEEP

    3072:fftffhJCuEmUBCSjGoLpmSTLd4W1CV9uymmH2Ri/:HVfhgujiXxfdA9Pm

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2