Extracted

• • Target

    1964c2686d6469cc44afefd42582375ec93128b0268355840f488a40840413ea

  • Size

    167KB

  • MD5

    4ddda7be0a1b6554ca1baa71f5ecc210

  • SHA1

    59dd6555b69b1bde0f8937f325b2445b0e184ed1

  • SHA256

    1964c2686d6469cc44afefd42582375ec93128b0268355840f488a40840413ea

  • SHA512

    ebe7a6c7ac132465c7a707b4a3b0c19466ca2ed5379b3f8c2a448827e6ec45ea1c8702e298cd41446918f6ac479b642a529261d2ca3749c33eee2022258ad852

  • SSDEEP

    3072:7YNQKPWDyiDRefVJltZrpRl1P3n8pCvmB4lU3UD2KdG:ENSDyKRO1thpyLid9c

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2