Extracted

• • Target

    0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2fN.exe

  • Size

    1.2MB

  • MD5

    948b45f0c26a433435f6b881d38fdf80

  • SHA1

    f996307d9fc781f322c3c4f659120eacbf412a02

  • SHA256

    0d1e840adbf67ef337c53ac47b139447a16601ea1de39329cc87a6ea9d1d4a2f

  • SHA512

    ecbad1e6197bb2a18e4c784cdff0c1ae832e1b73ede6e905b491f00bfc236c30546c78f162edb085bca8f9c858a1d3ea2978cc5172f7d12c789ee1a827c9b82d

  • SSDEEP

    24576:hvpH41Cl36RgrO/+sQWdKHsJYrrg0H+2UbDC:pmvQpOY3gH2UbD

  Score

  10^/10

  salitybackdoorbootkitdefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywarestealertrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2