Extracted

• • Target

    741410046c2f50f7454f82fefafd48699666d59c2a4302f74c3f91b174b3a30f

  • Size

    289KB

  • MD5

    645919cb94aac82b886845f9b7659700

  • SHA1

    f27ba1cf94bdfb07b9f7010a41038e9bc8b798f8

  • SHA256

    741410046c2f50f7454f82fefafd48699666d59c2a4302f74c3f91b174b3a30f

  • SHA512

    057ce9c1a0f3c677de22244fa0edd101824a8ed886ff0e0e5d7779b5219310a2c0869758543e5702a9b50ac79ed24be72643dd0273c08967aca3c3b65428db44

  • SSDEEP

    6144:FguMr/ZQaKtCRJ64xa8by+2Jw+Tv+cC7RGTpVrlXShIspwIn/+:FgzjKERJLa8bTkOkVrl8ISwIW

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2