Extracted

• • Target

    055defde720c27248ccf9f3822effd03c26619b20bfefa7ad6790e62ee64b42c

  • Size

    935KB

  • MD5

    6d9f9e3529b0d15b163ad29b545d29a0

  • SHA1

    1abeaab6070b7aad62815b63a8ce07a4bb19d74a

  • SHA256

    055defde720c27248ccf9f3822effd03c26619b20bfefa7ad6790e62ee64b42c

  • SHA512

    6068ae02b25b8b06c2f872db6732f18313636d3b1830131c579ca1a00a00bed0a742f7e7fd727b3fae2b680c388366694574ec19207152b21ad034cf75573e2f

  • SSDEEP

    24576:FlabsM8KGH7Co0OLeGrIocE5lArjPP9qMypvF:Fl08KGbNLeGMb4unHyl

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2