Extracted

Extracted

• • Target

    364e79d63bdff425fe5fc7616aa8973af5c74406eb30845d76fb5ba64079b775.exe

  • Size

    1.8MB

  • MD5

    1d1940b7775280d355fa25e70d7f17ec

  • SHA1

    cf79bbeaa4e37d9cbcb99b18ca04f52be2124793

  • SHA256

    364e79d63bdff425fe5fc7616aa8973af5c74406eb30845d76fb5ba64079b775

  • SHA512

    fd4b749a3c8293612087cb9e9d8db559d0ab05125f8517886f214d304d086022472237c1db834548cefccd1a8c305eb78be967f21988d06c43a7c6164beb8496

  • SSDEEP

    49152:bnsHyjtk2MYC5GDkY80D4YSbxIWvbqmmdtL4i96Ua:bnsmtk2a9YRmbSIKSi9e

  Score

  10^/10

  salityxredbackdoordefense_evasiondiscoverymacropersistencetrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2