Extracted

• • Target

    bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81

  • Size

    1.8MB

  • MD5

    b38b7365267b8fbea7781384bc638013

  • SHA1

    3c035caa90b2118a6ed1acbb557e9745e10e3981

  • SHA256

    bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81

  • SHA512

    c027e8cd2ab6400b4cacbf138bf4d589206028e728b625abacdce605c7284207c021c4ebee0ff7b49763a71911fd605ad85c13a6e99e72e29b20fe6f33495132

  • SSDEEP

    49152:KbTCfQxKCnFnQXBbrtgb/iQvu0UHOW96f:K6oxvWbrtUTrUHON

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2