Extracted

• • Target

    f54517b68fe248cbedcdbc5c4caa404a89248172ddf23606c58ce2c08e98e3ef

  • Size

    257KB

  • MD5

    338579039ceec32e31e44e9f849223e0

  • SHA1

    78f5c8f74d749fb13c1f266e2bb47c9d8472b930

  • SHA256

    f54517b68fe248cbedcdbc5c4caa404a89248172ddf23606c58ce2c08e98e3ef

  • SHA512

    8a87b2e6afecfe86b5bfc7eb410bd4efc8fb45c13b4f6e73f460acb1f48cb15424560951ad13c62dd849cd7664e9b9e26cf171758e29a9346188fdb219aed298

  • SSDEEP

    3072:jbszWOIzSiEL50jl7ywUNRD5bhQcp5rCcMdJgvgnFmp6ISnU/RDOb+nFmp6ISonr:0z3eZLUjD5qOmc7vIFmcjnU5DOSFmcjk

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2