Extracted

• • Target

    53824a6cb81f4652afd8b5bec0acb9e6169424cf889ccdb0e0763384026f8849N.exe

  • Size

    576KB

  • MD5

    e75eb7ec59b063d003c27d6a7beb0cb0

  • SHA1

    fd6b271010e01f5a63766dfabc23d96eb6cabdc8

  • SHA256

    53824a6cb81f4652afd8b5bec0acb9e6169424cf889ccdb0e0763384026f8849

  • SHA512

    6ec26ad4969758a619dba4755fd92c035d790cbcf7ce795daf647c54e9e3c074ee706b2505780f956d48a9fbc0c4c8fe7106974a0a4898e24820aee625899ad0

  • SSDEEP

    3072:Wo/L5tpV+CSA1AAPoCpxW5ATBfUNjpS1svkTVC9FieYTTLprx/m3qT4S826guKqf:DtpvoCpcNQ1jQdiJKFRvA+npAJkYEnr

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2