Extracted

• • Target

    19cf553733d4433b190d82b3ea1f6ff3bdf9958974dc63b7972797922731f5c0.exe

  • Size

    2.4MB

  • MD5

    77850f3d8702d42d8fec7c01ee0cf519

  • SHA1

    0985cc269672cbb25fdc453339ab075cc0118af0

  • SHA256

    19cf553733d4433b190d82b3ea1f6ff3bdf9958974dc63b7972797922731f5c0

  • SHA512

    552822a0d660b12dbe08b68daa28214985fa7204cb26f803b77abdd24e1cb505a79cfe225a393ca64f49cbf88015e5ad44798f8c047d3d92a22872fedaff41b9

  • SSDEEP

    49152:Xt5PaRrhN8LJcs5jjjNjjTfWOOwa2TQQsWIW7hxPYPjv5BfRowRALCQpQfnY:95CRrwHjNfq9H2TRsoPuvvCwACPY

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2