Extracted

• • Target

    c264099fc21d976e93e87402b892533ffe3ff71c54d9474f962d3a95152b6d89

  • Size

    187KB

  • MD5

    721ddaebd9792e44646817e89b4a9a70

  • SHA1

    7402bf6f4d0467b4e108ec6d7324601a093e8815

  • SHA256

    c264099fc21d976e93e87402b892533ffe3ff71c54d9474f962d3a95152b6d89

  • SHA512

    edc11e3e4bada67b64e7b6f7478e232b6995f182ec4773ef7a758b520046940539363bd8f0c4a5d3c871f197135e1705352b7b3d47607804e8d9c05f44e19de9

  • SSDEEP

    3072:l+FDzK71QkbstyJjCKICpC72s/mlaXBtvpROhvY0kLWHJweTI7knTc:l+I713bstyJj0sC7/HBBpRcQRLwiRl

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2