Extracted

• • Target

    586f095ba2d25ffac0430a9efb5373bd384606e3adb2f4d034119ba625232134N.exe

  • Size

    416KB

  • MD5

    3514014e6afb6d297fde6b6ea7173cc0

  • SHA1

    3bed675bb67c4d0cdd6c92cb9f1bf0a8c4d6c97a

  • SHA256

    586f095ba2d25ffac0430a9efb5373bd384606e3adb2f4d034119ba625232134

  • SHA512

    ba02a22938695d1adf2dd6a88e2d2db7eb004a105f3a20deecb960b8f61eac0437cea4542dccb754aff6b7cee66877296be142a3c5ef47f2c2585938c3e91d0c

  • SSDEEP

    6144:g+9dVYc7/0DIFVFMYk8LHFcrbXsCNytqZbMq+R1y9d268jrHi9QFonxnqO:P/0DcmYk8zFcetqZQ68noRIO

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2