Extracted

Extracted

• • Target

    5e72feba203fa56da4a7ec65a9355d14630ce8bd9f54ee5f857cc6db22b65880N.exe

  • Size

    1.8MB

  • MD5

    b66dff350d98b3483ac4210f9795c700

  • SHA1

    772093c38b60048b8d9b21635b13c9d5fff748a8

  • SHA256

    5e72feba203fa56da4a7ec65a9355d14630ce8bd9f54ee5f857cc6db22b65880

  • SHA512

    6d4a224777a2161189dc5bee70f063dd530703c9d2ed9a18f29512d40891658c2f72c6258763da8bc2088c58c46ef1b4a687950b0c92ff69598d8d57a1901863

  • SSDEEP

    49152:bnsHyjtk2MYC5GDkY80D4YSbxIWvbqmmdtL4i96UO:bnsmtk2a9YRmbSIKSi96

  Score

  10^/10

  salityxredbackdoordefense_evasiondiscoverypersistencetrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2