Extracted

• • Target

    e40cc7939dececa4d20d83280b97728059cfc444ac9de3c0ff4d1671ab6490f6.exe

  • Size

    1.1MB

  • MD5

    b2aec7ae0a095e59c8b98f9530302032

  • SHA1

    6007183f50375304a1465fd71cdb6d5dfd667209

  • SHA256

    e40cc7939dececa4d20d83280b97728059cfc444ac9de3c0ff4d1671ab6490f6

  • SHA512

    8226b09709b5744826bc6b57a07065952bf7e2af6687d330e3105c78f3d647b6da1def3afe453c7308de4304b64edc7b17842f26847f6887664c8b4222915147

  • SSDEEP

    24576:W1/aGLDCM4D8ayGMCPnXo8/4gflI2d+JdjyW:FD8ayGM0XoQr2jyW

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2