Extracted

• • Target

    325eb90e96a50a29f2e790f19b1a03ac95f9c6f1262e1840801de9d212b060edN.exe

  • Size

    1.9MB

  • MD5

    867c7366d3949b6a8c01607aa9bbc5f0

  • SHA1

    27b142f1399c4493de3f855793586aa5e402a63b

  • SHA256

    325eb90e96a50a29f2e790f19b1a03ac95f9c6f1262e1840801de9d212b060ed

  • SHA512

    9fd0ad42a0c64ee89ab552cf0f44d86af0be6f7afa77419e3f86c9dc64a517f0852fd2fef8919259ba81edee2808025a8786a079500d2a0c6e8e41a5b4043721

  • SSDEEP

    49152:PeDJbTCgaFxKCnFnQXBbrtgb/iQvu0UHOc7:PeDJ6hFxvWbrtUTrUHOO

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Modifies visibility of file extensions in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2