Extracted

• • Target

    4e413d99447f93977c0ef71daa6b79f265e5043398dfc3ba01d686f43122fb71N.exe

  • Size

    1.9MB

  • MD5

    4ea6690811d8ade65266abc0fb454180

  • SHA1

    2dcfea885823b13d27f69b3b74702698d444e613

  • SHA256

    4e413d99447f93977c0ef71daa6b79f265e5043398dfc3ba01d686f43122fb71

  • SHA512

    728a24325081e4b2bbcc6103aab6c70c85ec4f3365e65464af60cb7f9b8bf95546e986744a50928cf7c5113ef765a8e7cf722686ad143437ec3a7f7f7745cc54

  • SSDEEP

    49152:n8bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYm6:n86ZxvWbrtUTrUHO26

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupxpersistence

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2