Extracted

• • Target

    0e2720f7f366325df7c7a401bf8a7c6e8f1738e85e0734faa0d2e9eb2323596e.exe

  • Size

    1012KB

  • MD5

    a23c53f03531b812b41b596bf1bca909

  • SHA1

    a12d8025c0f3f0ea67ff059552c9ef842e1751c5

  • SHA256

    0e2720f7f366325df7c7a401bf8a7c6e8f1738e85e0734faa0d2e9eb2323596e

  • SHA512

    b4ccdfc44df57808b99e67b755ebb012cbc1a102aa696d123b0a169da63ddaaf06d02d18a531a1d08b5e2c947757bbfcf6516dfb961eef21cdc8dc19853110eb

  • SSDEEP

    24576:k1/aGLDCM4D8ayGM0R3o8/l3kAM8bb6HF7bdCUzn:3D8ayGM0ZoMX6HF3zn

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2