Extracted

• • Target

    e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5

  • Size

    3.5MB

  • MD5

    45db05360fd5a30d736276bd9511643e

  • SHA1

    c4f021f826a86786b1cf7548236aeaedc54cba4d

  • SHA256

    e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5

  • SHA512

    1a9b4eca38c5df1c2d82ee60de8c5c767346aadcaa0246f558ff132388be01bdf26ca07de4c7e5b381a7297f1e18635ae47707038c64fe02777af2ea7041efa4

  • SSDEEP

    98304:ont+QQwdB9q2Ic9FWx4yc1HlJXQcFLOAkGkzdnEVomFHKnP1lTD:ouwUo11HlJX9FLOyomFHKnP15D

  Score

  10^/10

  salitybackdoordiscoveryevasionexecutionpersistencetrojanupx

  • Disables service(s)

    evasionexecution

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2