Extracted

• • Target

    b95f42c66f6989263792fb1915222b495e7e55386de625d0b4671de6767a08e8.exe

  • Size

    2.4MB

  • MD5

    2f93a73b9f790ee7d672caa33c527d78

  • SHA1

    9a3f71ea06cd9819f82c3d4dbb271986975c7845

  • SHA256

    b95f42c66f6989263792fb1915222b495e7e55386de625d0b4671de6767a08e8

  • SHA512

    a14b924cd8ca31b0cb48c4f8465e04458197d6a934c0d08742f96e842c5f3924c8eba192f68b6c550c221f8aea8e1aab351252e1348b26022e4b8ce3e9e12d70

  • SSDEEP

    49152:7NHBYCfHLr3AZAUouIho0rDCEJNOy3ZbtOEeKD58Gy8ra52vk:7hhDUZ9ozLHJ0gtbD508rbvk

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2