Extracted

• • Target

    d6460765b1a383e9225036a62eb19f99c89a9608c671a16e5f7b0a28191c5d43

  • Size

    216KB

  • MD5

    a18313844fdd46bb26b4b23d4b11ba30

  • SHA1

    f45feca7187cc98b9f7fbe2148383d0c7383a1a4

  • SHA256

    d6460765b1a383e9225036a62eb19f99c89a9608c671a16e5f7b0a28191c5d43

  • SHA512

    c13e292b02962bd9f313920cb6ccc63e07758b6469bbd40c2f16d055a4595ad22926c33ae4686a3cd20f87ee09b019550c0d41173c8cb15458f80f0b8e48e4d5

  • SSDEEP

    6144:H5wplxAAZcR/6TkIN2OKB8g+3/2bArgwL2k1iN:H5eXC1ryg+ubKg+2k

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2