Extracted

• • Target

    00002475ff8f62ef167ae0ca564bc206e1dcb1549fc14fae5c35fb65b66fd35f

  • Size

    464KB

  • MD5

    59b5e5a7547053f923963a56a8b7bdbf

  • SHA1

    4c3ce8f1d16639b82b3556c3f3665d83949415d2

  • SHA256

    00002475ff8f62ef167ae0ca564bc206e1dcb1549fc14fae5c35fb65b66fd35f

  • SHA512

    f43c79e0335b418f0ca88ede9ccd9fcf3f25737cb34e3c56be6fd17ccde9da805f240063d1030079f68d3f8d2f302fc213055453803004f55fa7a0dc14a7d4f4

  • SSDEEP

    6144:5afsiuvAQ+tTm6cyERSiytj71cwE4jKS6vlxQqyRqpYNLA:uCvAQ+q6ctRt636wfjOHm1c

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverypersistencetrojanupxspywarestealer

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2