Extracted

• • Target

    56b29e6cfc65618539437b9d58231d1b733362fdcb6f30e7435adc3dcdf215bdN.exe

  • Size

    1.8MB

  • MD5

    fd21acd09d1d06345672d9dc7564b2d0

  • SHA1

    a3bdfa50f61c3bee187f741336e3908a609c9e00

  • SHA256

    56b29e6cfc65618539437b9d58231d1b733362fdcb6f30e7435adc3dcdf215bd

  • SHA512

    28361e8bd30e25dd50190b35b7489caeb280e39cdc18bcf447bae7002e0dc08d5a3222b18be19a9c6f335bbe8cfb41fcd08506f7883ed33f016395cfed386618

  • SSDEEP

    49152:sbTC9RxKCnFnQXBbrtgb/iQvu0UHOaYmLCm:s6zxvWbrtUTrUHO2h

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2