Extracted

• • Target

    0c2a978e9f51ba7690b1fe4efb6baaf923fb4dd55476dbdfe346c2715e49e45f

  • Size

    300KB

  • MD5

    1c41e056f4e47f3c4ac778e315900e6a

  • SHA1

    eb415bd077e00425f04a9ed7d63e72f84c4de91c

  • SHA256

    0c2a978e9f51ba7690b1fe4efb6baaf923fb4dd55476dbdfe346c2715e49e45f

  • SHA512

    6c1b15e923d7b992702fa6c60503479e17ab4c13898f1a8d8e6e8b901f8be85138c0f801e22f6c178dcacc4c4a7ff5360a6b27ccc25f820c2149e639cee6dc4e

  • SSDEEP

    6144:nTc5EeHxDkl9NF86Q4bw10yxASP/tpm73I7j5cRIWjrZs:njeHhz6+1/xj12UjiRIgs

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2