Extracted

• • Target

    ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3

  • Size

    366KB

  • MD5

    813dcaf28cee6ea257882f46007190da

  • SHA1

    829406ae21a8b23b58121dcfeb5a1c134100ebed

  • SHA256

    ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3

  • SHA512

    0c381ec3d674a2f4c0b9611bdca3e1a2227cc5dc1a9166e040cc0ba664b7a547d66949804fabb98f8060ccdc944f38e7316f59f2555d8d74a245da02dc875c54

  • SSDEEP

    3072:fQL/bCrwIPe5ML7nwkg7jqeQYu4Xap39Vp0zrY2cNtRf4WTHzSSfNlF4HteAlMvK:fQL/bCr5KnQYdapXpMcyWTHxl28AlM

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies visibility of file extensions in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2