Extracted

• • Target

    44e287fe6a9916ed3d0f984a21ea33e3ab554f970a7d2fd32d82c286399d3c7b

  • Size

    1.8MB

  • MD5

    aac12149429e9c1770d6e4961c07533e

  • SHA1

    a6318976aeb0164108f9ac1c93593a3a0f90682f

  • SHA256

    44e287fe6a9916ed3d0f984a21ea33e3ab554f970a7d2fd32d82c286399d3c7b

  • SHA512

    9f73f70325088610173f66400adfaa63825e602311b9e11abbb08d7d2f91e50109a76c8d87313fe69770d5105c1b47352626fbefeb033bb8fc3815575c55a18e

  • SSDEEP

    49152:mSU3ky/VaNbbridO5vT8mJotZfNDAhhhxTjF17C:mS9y/INbbrh5bhmtPDWXD7C

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistenceprivilege_escalationtrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2