Extracted

• • Target

    16d35f6f66566fa1e2c5cf0a59f4b5d46e0010fd390aa46a583b973163224329N.exe

  • Size

    1012KB

  • MD5

    d25f4bf875cb466299294d71b8e92030

  • SHA1

    3bab8b99e4fc44f61e42ad6ba080dca6487af916

  • SHA256

    16d35f6f66566fa1e2c5cf0a59f4b5d46e0010fd390aa46a583b973163224329

  • SHA512

    e68d3ce1569edb47f1c000eee242e66679a8f7758fd0bb3d91328b3ad6a38b6624b8b450a10b13eec09ca6f2dd341361a2b164ce182891cc97003d5c75c198a0

  • SSDEEP

    24576:k1/aGLDCM4D8ayGM0R3o8/aVDs3nup7rGJbeMJ+1Yk:3D8ayGM0ZozWJ+1R

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2