Extracted

• • Target

    56c64ec156a82909e1dd840aa486df03deacfb968434535144996b797891d0ec

  • Size

    570KB

  • MD5

    64040c854ab99f3e6ad37e5f7d295af4

  • SHA1

    b61ee2b2d78fa25bc50e879a6d6a53549bfb2351

  • SHA256

    56c64ec156a82909e1dd840aa486df03deacfb968434535144996b797891d0ec

  • SHA512

    5a1181c33b7e04a161535d92b9eaece1002d6784459f3746e3b988fce791357fcff7f314f631815bf62fd71b640b2d842273398fc50ace1e77e342038241cb5d

  • SSDEEP

    12288:auS+LdX8fmHJaSJS96XnN3kAty5GhDu3/bo+ncDTms6K5OQt1:nUfmHJaSJZ5kAtyEhDuPboUcDJHT

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2