Extracted

• • Target

    2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe

  • Size

    1012KB

  • MD5

    ad28c9805e5eb87d99463a1924e56200

  • SHA1

    3d9b780eca5d339acaa84b6c0455adb746c6f595

  • SHA256

    2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797

  • SHA512

    cb76e668f8d8285cf261a530ed0280ade80212eaef6ef440bc8f435fc1354faf406da56212ee70bd10d8ca74a52a68aec37662cf45cf5e88a186e3ed7b7737e4

  • SSDEEP

    24576:k1/aGLDCM4D8ayGM0R3o8/l3kAM8bb6HF7bdCUzl:3D8ayGM0ZoMX6HF3zl

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2