Extracted

• • Target

    2f19beaf8472389ddd42493af49185cb0e656bfb2aa96a36a3fe05b7b2f6d03cN.exe

  • Size

    1.1MB

  • MD5

    c832f6489b257134b75c3108b02c3bd0

  • SHA1

    3c0e169c5b51d3cd599afaec3559408ee0978f1a

  • SHA256

    2f19beaf8472389ddd42493af49185cb0e656bfb2aa96a36a3fe05b7b2f6d03c

  • SHA512

    0dc42315fba0c7ece9257092787401748e12ded10fca2648ed3949b1732c8257d5893c39d3c42bfd9a7e37689213016c6da40574454d46386547e910e4226650

  • SSDEEP

    24576:W1/aGLDCM4D8ayGMCPnXo8/18o4YYfDV7I8qgk4YkVvfKtbFVixj4uLhYfqa:FD8ayGM0XolV7I8rYkVvfKtbFVixj4uw

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2