Extracted

• • Target

    e90d50b767df3ffc3113e0ea15d0128c9b81e7d2ff0e33d834b7d0539dd7ca02N.exe

  • Size

    1012KB

  • MD5

    3c8349453436e1bb2383d81edf04c550

  • SHA1

    3da06cb3376b1721e4d875c10f5a6953662abcf0

  • SHA256

    e90d50b767df3ffc3113e0ea15d0128c9b81e7d2ff0e33d834b7d0539dd7ca02

  • SHA512

    59f49b92a3cd5fb3abe683c6c19747d2c7986469caafc266f81b409e8a12975df59c3db2787acebd35d626fdc0d3c8a82d16527679abfceea7ca780a44d411f1

  • SSDEEP

    12288:k1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0INK4h1oWxJpcEi0/3IWV//7cSd8HR4bm:k1/aGLDCM4D8ayGM0R3o8/oAuylKi+t

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2