Extracted

• • Target

    83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749.exe

  • Size

    416KB

  • MD5

    5eada170dd29ecd50a783d0877e6f022

  • SHA1

    d79443bc32e06f098a2f9449c02703e83b0705d5

  • SHA256

    83c28113bcfc9054668a6a4213ff3d2b3f03ed4e96d3b18d78e4f6dbd9fb5749

  • SHA512

    8f27265ccfe24422027791076ef9b6f4cdfb011f2f1cb1b3b1bb5c5559f391cf23f2f6ec0ec4334063c6574f43b4fa4a15048c426d1173e4a71f51914c7d390c

  • SSDEEP

    6144:UFfDAEl3nOvkGe/DDWGszKjV1eNHkG+ovUM3ep3DWhvhlWOAB:kwGDWGszKjV1eWGL5epTWhvhl1K

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2