Extracted

• • Target

    ce8c532ddb51155f91b23426c990269d277bb28bfc99273a0077e136459ce63bN.exe

  • Size

    1.1MB

  • MD5

    1c3698bbc99f0bea453d76b58d12ba20

  • SHA1

    3dafb852d25011923f7d02678acb57a19193e1d6

  • SHA256

    ce8c532ddb51155f91b23426c990269d277bb28bfc99273a0077e136459ce63b

  • SHA512

    cd6e5c19d0a173570ed81cf1e54f9f7d1364d1e2f1750fa83d9a4e20c89f7129ebccf8e7a66b05f94ff54fb9c5836ebea9373cd300c72a5a96d36467d56c4653

  • SSDEEP

    24576:W1/aGLDCM4D8ayGMCPnXo8/4gflI2d+JdjyS:FD8ayGM0XoQr2jyS

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2