Extracted

• • Target

    e1f15bcc8dcc4deb98c900e94b3b05e18fc91a3575c006aa46e157ec2e921e92.exe

  • Size

    1.6MB

  • MD5

    eec2e9d94ba4eb58ff61c47b35114920

  • SHA1

    4f02e6786c5512fac6534bebad67af6ad0f74b93

  • SHA256

    e1f15bcc8dcc4deb98c900e94b3b05e18fc91a3575c006aa46e157ec2e921e92

  • SHA512

    2db66eb69503dcfb552488e35fc4a549f624d65d6548e4eadf92fb946b2b0d6a537b686090e4d587a5d932764e1f257bd95e4a739e98163851c04f8e0f09885b

  • SSDEEP

    49152:3PTlJDWxFp4ooqVbpKCnCO27fGp7wbnW3f:3pJqNoqjYBGYW3f

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2