Extracted

• • Target

    5fcbfba6fd342cbad6bb760be41e0f0ae2c653792151c4205d9b86184ffb54cd

  • Size

    843KB

  • MD5

    69b1bb17ac433ea2f1a8b9ab93c102f0

  • SHA1

    e7b5ffbfe877a2cb520b29ff51f7478df7ed0c32

  • SHA256

    5fcbfba6fd342cbad6bb760be41e0f0ae2c653792151c4205d9b86184ffb54cd

  • SHA512

    6076005f260de176f82933d86c7696d4062265de6008d4d6e623873ff338156cd6f94c9bfb83483b2444ce7e3d134bde613974d4007f395ad80955f648d65b9b

  • SSDEEP

    24576:r19gV3Jme5FJjs2T2kW7rsiF86nwR1IsOM4j4gB:xKV3JbzakGIiF8mwR9ON/

  Score

  10^/10

  upxsalitybackdoorevasiontrojan

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2