Extracted

• • Target
    a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24.exe
  • Size 348KB
  • SHA256 a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24
  • MD5 468293d1f8dbada1de29e446a214ac05
  • SHA1 29f1655d3f3b83c90bfaba74dcef73473d451374
  • SHA512 0e03af3782c6d773b12185bc015ed2e4b9f6a1e6e6456dcf08d375d0979e1cf33439992934d812f5bbd2fef812aadfdb0927d0d9f97ca506a2af0dd8d485c5e9
  • SSDEEP 3072:xOXQ9G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SCEo6qfuOk3dxeHXJ:SsGlpQEQAMtqNUzCVufufdm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorcredential_accessdiscoveryevasionpersistencespywarestealertrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2