Extracted

• • Target

    772a15fe0d9e560f0bb614ccae0d9390N.exe

  • Size

    386KB

  • MD5

    772a15fe0d9e560f0bb614ccae0d9390

  • SHA1

    7775d19c00eeb191f7e8cbbb7e33629c73f29f2d

  • SHA256

    fba8ea4fa581c0c8addf50add60f7e8e48cfdb4d5908e7caaabbabe7279eaf2f

  • SHA512

    7e78df28ad82a7de644a4de141f8b73dca77493b4da8228b231b04d01f651ce4029fec55c9da669363b0c67b4f52f3592557555cdc42744c0e7f7cc5ff54d94e

  • SSDEEP

    12288:E+YcUc6SBLLTSEgBAnhc1kGsxQqxemT6OhJ:Ev2BLHSn6q1BnSJ

  Score

  10^/10

  upxsalitybackdoorevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1behavioral2