Extracted

• • Target

    d8deb759318419ff4f15560be2bb3fbddb9dba9cf8d03f08a995fce4f251d2ce

  • Size

    300KB

  • MD5

    f55a4da1aa2e88af5f51b5191985378c

  • SHA1

    5e76168724f704808b258d6a8b592c3d4c647208

  • SHA256

    d8deb759318419ff4f15560be2bb3fbddb9dba9cf8d03f08a995fce4f251d2ce

  • SHA512

    9f20a6c8a70ec8241471f110428447dfa3e13b24850e3d49fc0f769c14b966a67f8cd070f24098ef92b907fc399a81335c4e5e134ecf19da0a58e7123eb96b17

  • SSDEEP

    3072:Wv9KRMzPhCjG8G3GbGVGBGfGuGxGWYcrf6KadEz8pMY9K8diqayh1SR3lQonH:Wv0RMzPAYcD6KadLhK8Eq9UlQ0H

  Score

  10^/10

  discoverysalitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2