Extracted

• • Target
    8e78759e6daa62d7658869dc96346e09cebcb952ccb0f2b6d6ccc37b52f35277
  • Size 1.1MB
  • SHA256 8e78759e6daa62d7658869dc96346e09cebcb952ccb0f2b6d6ccc37b52f35277
  • MD5 acb561ff4fb141bb54f1c46432216e9b
  • SHA1 480b0358d491be0bff1f34100c934befbec748ba
  • SHA512 35b3bc1a49720962475b5ddae7facfcac85b5fdae3c9e44456b975c083d8e381e68dd8f00a1d9bf1d8ca0a562604e168ed90bbc6518929f008d2e36316bcee5a
  • SSDEEP 12288:W1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0crPxVcEoWxJpcEi0/3IWV//7cSdG+Emi:W1/aGLDCM4D8ayGMCPnXo8/xX+nBTZt
  • TLSH
    T129356C07A24A0D77D9D32FB44D97D77A92389E204C2ECB965A00DF2FA6E37906D59303
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1