Extracted

• • Target

    f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179

  • Size

    167KB

  • MD5

    4e8bd18c20a9b053f9727eb5f8e3c037

  • SHA1

    5d4750302bbef963434d8ce660a9ba618987cf5f

  • SHA256

    f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179

  • SHA512

    48a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393

  • SSDEEP

    3072:hvzNWVMw6g5ZX73Plewmh0Bx4rWDNvXwmas/V74Ilj3qozhAvsx:FNWVM5wmSErWpvNeIp7Sy

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2